xref: /openbmc/qemu/hw/display/cirrus_vga.c (revision 77a8257e)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "hw/hw.h"
30 #include "hw/pci/pci.h"
31 #include "ui/console.h"
32 #include "ui/pixel_ops.h"
33 #include "vga_int.h"
34 #include "hw/loader.h"
35 
36 /*
37  * TODO:
38  *    - destination write mask support not complete (bits 5..7)
39  *    - optimize linear mappings
40  *    - optimize bitblt functions
41  */
42 
43 //#define DEBUG_CIRRUS
44 //#define DEBUG_BITBLT
45 
46 /***************************************
47  *
48  *  definitions
49  *
50  ***************************************/
51 
52 // ID
53 #define CIRRUS_ID_CLGD5422  (0x23<<2)
54 #define CIRRUS_ID_CLGD5426  (0x24<<2)
55 #define CIRRUS_ID_CLGD5424  (0x25<<2)
56 #define CIRRUS_ID_CLGD5428  (0x26<<2)
57 #define CIRRUS_ID_CLGD5430  (0x28<<2)
58 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
59 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
60 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
61 
62 // sequencer 0x07
63 #define CIRRUS_SR7_BPP_VGA            0x00
64 #define CIRRUS_SR7_BPP_SVGA           0x01
65 #define CIRRUS_SR7_BPP_MASK           0x0e
66 #define CIRRUS_SR7_BPP_8              0x00
67 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
68 #define CIRRUS_SR7_BPP_24             0x04
69 #define CIRRUS_SR7_BPP_16             0x06
70 #define CIRRUS_SR7_BPP_32             0x08
71 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
72 
73 // sequencer 0x0f
74 #define CIRRUS_MEMSIZE_512k        0x08
75 #define CIRRUS_MEMSIZE_1M          0x10
76 #define CIRRUS_MEMSIZE_2M          0x18
77 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
78 
79 // sequencer 0x12
80 #define CIRRUS_CURSOR_SHOW         0x01
81 #define CIRRUS_CURSOR_HIDDENPEL    0x02
82 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
83 
84 // sequencer 0x17
85 #define CIRRUS_BUSTYPE_VLBFAST   0x10
86 #define CIRRUS_BUSTYPE_PCI       0x20
87 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
88 #define CIRRUS_BUSTYPE_ISA       0x38
89 #define CIRRUS_MMIO_ENABLE       0x04
90 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
91 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
92 
93 // control 0x0b
94 #define CIRRUS_BANKING_DUAL             0x01
95 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
96 
97 // control 0x30
98 #define CIRRUS_BLTMODE_BACKWARDS        0x01
99 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
100 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
101 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
102 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
103 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
104 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
105 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
106 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
107 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
108 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
109 
110 // control 0x31
111 #define CIRRUS_BLT_BUSY                 0x01
112 #define CIRRUS_BLT_START                0x02
113 #define CIRRUS_BLT_RESET                0x04
114 #define CIRRUS_BLT_FIFOUSED             0x10
115 #define CIRRUS_BLT_AUTOSTART            0x80
116 
117 // control 0x32
118 #define CIRRUS_ROP_0                    0x00
119 #define CIRRUS_ROP_SRC_AND_DST          0x05
120 #define CIRRUS_ROP_NOP                  0x06
121 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
122 #define CIRRUS_ROP_NOTDST               0x0b
123 #define CIRRUS_ROP_SRC                  0x0d
124 #define CIRRUS_ROP_1                    0x0e
125 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
126 #define CIRRUS_ROP_SRC_XOR_DST          0x59
127 #define CIRRUS_ROP_SRC_OR_DST           0x6d
128 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
129 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
130 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
131 #define CIRRUS_ROP_NOTSRC               0xd0
132 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
133 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
134 
135 #define CIRRUS_ROP_NOP_INDEX 2
136 #define CIRRUS_ROP_SRC_INDEX 5
137 
138 // control 0x33
139 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
140 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
141 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
142 
143 // memory-mapped IO
144 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
145 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
146 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
147 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
148 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
149 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
150 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
151 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
152 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
153 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
154 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
155 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
156 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
157 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
158 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
159 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
160 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
161 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
162 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
166 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
167 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
168 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
169 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
170 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
171 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
172 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
173 
174 #define CIRRUS_PNPMMIO_SIZE         0x1000
175 
176 struct CirrusVGAState;
177 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
178                                      uint8_t * dst, const uint8_t * src,
179 				     int dstpitch, int srcpitch,
180 				     int bltwidth, int bltheight);
181 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
182                               uint8_t *dst, int dst_pitch, int width, int height);
183 
184 typedef struct CirrusVGAState {
185     VGACommonState vga;
186 
187     MemoryRegion cirrus_vga_io;
188     MemoryRegion cirrus_linear_io;
189     MemoryRegion cirrus_linear_bitblt_io;
190     MemoryRegion cirrus_mmio_io;
191     MemoryRegion pci_bar;
192     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
193     MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
194     MemoryRegion low_mem;           /* always mapped, overridden by: */
195     MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
196     uint32_t cirrus_addr_mask;
197     uint32_t linear_mmio_mask;
198     uint8_t cirrus_shadow_gr0;
199     uint8_t cirrus_shadow_gr1;
200     uint8_t cirrus_hidden_dac_lockindex;
201     uint8_t cirrus_hidden_dac_data;
202     uint32_t cirrus_bank_base[2];
203     uint32_t cirrus_bank_limit[2];
204     uint8_t cirrus_hidden_palette[48];
205     int cirrus_blt_pixelwidth;
206     int cirrus_blt_width;
207     int cirrus_blt_height;
208     int cirrus_blt_dstpitch;
209     int cirrus_blt_srcpitch;
210     uint32_t cirrus_blt_fgcol;
211     uint32_t cirrus_blt_bgcol;
212     uint32_t cirrus_blt_dstaddr;
213     uint32_t cirrus_blt_srcaddr;
214     uint8_t cirrus_blt_mode;
215     uint8_t cirrus_blt_modeext;
216     cirrus_bitblt_rop_t cirrus_rop;
217 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
218     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
219     uint8_t *cirrus_srcptr;
220     uint8_t *cirrus_srcptr_end;
221     uint32_t cirrus_srccounter;
222     /* hwcursor display state */
223     int last_hw_cursor_size;
224     int last_hw_cursor_x;
225     int last_hw_cursor_y;
226     int last_hw_cursor_y_start;
227     int last_hw_cursor_y_end;
228     int real_vram_size; /* XXX: suppress that */
229     int device_id;
230     int bustype;
231 } CirrusVGAState;
232 
233 typedef struct PCICirrusVGAState {
234     PCIDevice dev;
235     CirrusVGAState cirrus_vga;
236 } PCICirrusVGAState;
237 
238 #define TYPE_ISA_CIRRUS_VGA "isa-cirrus-vga"
239 #define ISA_CIRRUS_VGA(obj) \
240     OBJECT_CHECK(ISACirrusVGAState, (obj), TYPE_ISA_CIRRUS_VGA)
241 
242 typedef struct ISACirrusVGAState {
243     ISADevice parent_obj;
244 
245     CirrusVGAState cirrus_vga;
246 } ISACirrusVGAState;
247 
248 static uint8_t rop_to_index[256];
249 
250 /***************************************
251  *
252  *  prototypes.
253  *
254  ***************************************/
255 
256 
257 static void cirrus_bitblt_reset(CirrusVGAState *s);
258 static void cirrus_update_memory_access(CirrusVGAState *s);
259 
260 /***************************************
261  *
262  *  raster operations
263  *
264  ***************************************/
265 
266 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
267                                   int32_t pitch, int32_t addr)
268 {
269     if (pitch < 0) {
270         int64_t min = addr
271             + ((int64_t)s->cirrus_blt_height-1) * pitch;
272         int32_t max = addr
273             + s->cirrus_blt_width;
274         if (min < 0 || max >= s->vga.vram_size) {
275             return true;
276         }
277     } else {
278         int64_t max = addr
279             + ((int64_t)s->cirrus_blt_height-1) * pitch
280             + s->cirrus_blt_width;
281         if (max >= s->vga.vram_size) {
282             return true;
283         }
284     }
285     return false;
286 }
287 
288 static bool blit_is_unsafe(struct CirrusVGAState *s)
289 {
290     /* should be the case, see cirrus_bitblt_start */
291     assert(s->cirrus_blt_width > 0);
292     assert(s->cirrus_blt_height > 0);
293 
294     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
295         return true;
296     }
297 
298     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
299                               s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
300         return true;
301     }
302     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
303                               s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
304         return true;
305     }
306 
307     return false;
308 }
309 
310 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
311                                   uint8_t *dst,const uint8_t *src,
312                                   int dstpitch,int srcpitch,
313                                   int bltwidth,int bltheight)
314 {
315 }
316 
317 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
318                                    uint8_t *dst,
319                                    int dstpitch, int bltwidth,int bltheight)
320 {
321 }
322 
323 #define ROP_NAME 0
324 #define ROP_FN(d, s) 0
325 #include "cirrus_vga_rop.h"
326 
327 #define ROP_NAME src_and_dst
328 #define ROP_FN(d, s) (s) & (d)
329 #include "cirrus_vga_rop.h"
330 
331 #define ROP_NAME src_and_notdst
332 #define ROP_FN(d, s) (s) & (~(d))
333 #include "cirrus_vga_rop.h"
334 
335 #define ROP_NAME notdst
336 #define ROP_FN(d, s) ~(d)
337 #include "cirrus_vga_rop.h"
338 
339 #define ROP_NAME src
340 #define ROP_FN(d, s) s
341 #include "cirrus_vga_rop.h"
342 
343 #define ROP_NAME 1
344 #define ROP_FN(d, s) ~0
345 #include "cirrus_vga_rop.h"
346 
347 #define ROP_NAME notsrc_and_dst
348 #define ROP_FN(d, s) (~(s)) & (d)
349 #include "cirrus_vga_rop.h"
350 
351 #define ROP_NAME src_xor_dst
352 #define ROP_FN(d, s) (s) ^ (d)
353 #include "cirrus_vga_rop.h"
354 
355 #define ROP_NAME src_or_dst
356 #define ROP_FN(d, s) (s) | (d)
357 #include "cirrus_vga_rop.h"
358 
359 #define ROP_NAME notsrc_or_notdst
360 #define ROP_FN(d, s) (~(s)) | (~(d))
361 #include "cirrus_vga_rop.h"
362 
363 #define ROP_NAME src_notxor_dst
364 #define ROP_FN(d, s) ~((s) ^ (d))
365 #include "cirrus_vga_rop.h"
366 
367 #define ROP_NAME src_or_notdst
368 #define ROP_FN(d, s) (s) | (~(d))
369 #include "cirrus_vga_rop.h"
370 
371 #define ROP_NAME notsrc
372 #define ROP_FN(d, s) (~(s))
373 #include "cirrus_vga_rop.h"
374 
375 #define ROP_NAME notsrc_or_dst
376 #define ROP_FN(d, s) (~(s)) | (d)
377 #include "cirrus_vga_rop.h"
378 
379 #define ROP_NAME notsrc_and_notdst
380 #define ROP_FN(d, s) (~(s)) & (~(d))
381 #include "cirrus_vga_rop.h"
382 
383 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
384     cirrus_bitblt_rop_fwd_0,
385     cirrus_bitblt_rop_fwd_src_and_dst,
386     cirrus_bitblt_rop_nop,
387     cirrus_bitblt_rop_fwd_src_and_notdst,
388     cirrus_bitblt_rop_fwd_notdst,
389     cirrus_bitblt_rop_fwd_src,
390     cirrus_bitblt_rop_fwd_1,
391     cirrus_bitblt_rop_fwd_notsrc_and_dst,
392     cirrus_bitblt_rop_fwd_src_xor_dst,
393     cirrus_bitblt_rop_fwd_src_or_dst,
394     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
395     cirrus_bitblt_rop_fwd_src_notxor_dst,
396     cirrus_bitblt_rop_fwd_src_or_notdst,
397     cirrus_bitblt_rop_fwd_notsrc,
398     cirrus_bitblt_rop_fwd_notsrc_or_dst,
399     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
400 };
401 
402 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
403     cirrus_bitblt_rop_bkwd_0,
404     cirrus_bitblt_rop_bkwd_src_and_dst,
405     cirrus_bitblt_rop_nop,
406     cirrus_bitblt_rop_bkwd_src_and_notdst,
407     cirrus_bitblt_rop_bkwd_notdst,
408     cirrus_bitblt_rop_bkwd_src,
409     cirrus_bitblt_rop_bkwd_1,
410     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
411     cirrus_bitblt_rop_bkwd_src_xor_dst,
412     cirrus_bitblt_rop_bkwd_src_or_dst,
413     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
414     cirrus_bitblt_rop_bkwd_src_notxor_dst,
415     cirrus_bitblt_rop_bkwd_src_or_notdst,
416     cirrus_bitblt_rop_bkwd_notsrc,
417     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
418     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
419 };
420 
421 #define TRANSP_ROP(name) {\
422     name ## _8,\
423     name ## _16,\
424         }
425 #define TRANSP_NOP(func) {\
426     func,\
427     func,\
428         }
429 
430 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
431     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
432     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
433     TRANSP_NOP(cirrus_bitblt_rop_nop),
434     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
435     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
436     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
437     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
438     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
439     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
440     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
441     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
442     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
443     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
444     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
445     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
446     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
447 };
448 
449 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
450     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
451     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
452     TRANSP_NOP(cirrus_bitblt_rop_nop),
453     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
454     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
455     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
456     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
457     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
458     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
459     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
460     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
461     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
462     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
463     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
464     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
465     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
466 };
467 
468 #define ROP2(name) {\
469     name ## _8,\
470     name ## _16,\
471     name ## _24,\
472     name ## _32,\
473         }
474 
475 #define ROP_NOP2(func) {\
476     func,\
477     func,\
478     func,\
479     func,\
480         }
481 
482 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
483     ROP2(cirrus_patternfill_0),
484     ROP2(cirrus_patternfill_src_and_dst),
485     ROP_NOP2(cirrus_bitblt_rop_nop),
486     ROP2(cirrus_patternfill_src_and_notdst),
487     ROP2(cirrus_patternfill_notdst),
488     ROP2(cirrus_patternfill_src),
489     ROP2(cirrus_patternfill_1),
490     ROP2(cirrus_patternfill_notsrc_and_dst),
491     ROP2(cirrus_patternfill_src_xor_dst),
492     ROP2(cirrus_patternfill_src_or_dst),
493     ROP2(cirrus_patternfill_notsrc_or_notdst),
494     ROP2(cirrus_patternfill_src_notxor_dst),
495     ROP2(cirrus_patternfill_src_or_notdst),
496     ROP2(cirrus_patternfill_notsrc),
497     ROP2(cirrus_patternfill_notsrc_or_dst),
498     ROP2(cirrus_patternfill_notsrc_and_notdst),
499 };
500 
501 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
502     ROP2(cirrus_colorexpand_transp_0),
503     ROP2(cirrus_colorexpand_transp_src_and_dst),
504     ROP_NOP2(cirrus_bitblt_rop_nop),
505     ROP2(cirrus_colorexpand_transp_src_and_notdst),
506     ROP2(cirrus_colorexpand_transp_notdst),
507     ROP2(cirrus_colorexpand_transp_src),
508     ROP2(cirrus_colorexpand_transp_1),
509     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
510     ROP2(cirrus_colorexpand_transp_src_xor_dst),
511     ROP2(cirrus_colorexpand_transp_src_or_dst),
512     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
513     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
514     ROP2(cirrus_colorexpand_transp_src_or_notdst),
515     ROP2(cirrus_colorexpand_transp_notsrc),
516     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
517     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
518 };
519 
520 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
521     ROP2(cirrus_colorexpand_0),
522     ROP2(cirrus_colorexpand_src_and_dst),
523     ROP_NOP2(cirrus_bitblt_rop_nop),
524     ROP2(cirrus_colorexpand_src_and_notdst),
525     ROP2(cirrus_colorexpand_notdst),
526     ROP2(cirrus_colorexpand_src),
527     ROP2(cirrus_colorexpand_1),
528     ROP2(cirrus_colorexpand_notsrc_and_dst),
529     ROP2(cirrus_colorexpand_src_xor_dst),
530     ROP2(cirrus_colorexpand_src_or_dst),
531     ROP2(cirrus_colorexpand_notsrc_or_notdst),
532     ROP2(cirrus_colorexpand_src_notxor_dst),
533     ROP2(cirrus_colorexpand_src_or_notdst),
534     ROP2(cirrus_colorexpand_notsrc),
535     ROP2(cirrus_colorexpand_notsrc_or_dst),
536     ROP2(cirrus_colorexpand_notsrc_and_notdst),
537 };
538 
539 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
540     ROP2(cirrus_colorexpand_pattern_transp_0),
541     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
542     ROP_NOP2(cirrus_bitblt_rop_nop),
543     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
544     ROP2(cirrus_colorexpand_pattern_transp_notdst),
545     ROP2(cirrus_colorexpand_pattern_transp_src),
546     ROP2(cirrus_colorexpand_pattern_transp_1),
547     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
548     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
549     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
550     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
551     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
552     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
553     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
554     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
555     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
556 };
557 
558 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
559     ROP2(cirrus_colorexpand_pattern_0),
560     ROP2(cirrus_colorexpand_pattern_src_and_dst),
561     ROP_NOP2(cirrus_bitblt_rop_nop),
562     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
563     ROP2(cirrus_colorexpand_pattern_notdst),
564     ROP2(cirrus_colorexpand_pattern_src),
565     ROP2(cirrus_colorexpand_pattern_1),
566     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
567     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
568     ROP2(cirrus_colorexpand_pattern_src_or_dst),
569     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
570     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
571     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
572     ROP2(cirrus_colorexpand_pattern_notsrc),
573     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
574     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
575 };
576 
577 static const cirrus_fill_t cirrus_fill[16][4] = {
578     ROP2(cirrus_fill_0),
579     ROP2(cirrus_fill_src_and_dst),
580     ROP_NOP2(cirrus_bitblt_fill_nop),
581     ROP2(cirrus_fill_src_and_notdst),
582     ROP2(cirrus_fill_notdst),
583     ROP2(cirrus_fill_src),
584     ROP2(cirrus_fill_1),
585     ROP2(cirrus_fill_notsrc_and_dst),
586     ROP2(cirrus_fill_src_xor_dst),
587     ROP2(cirrus_fill_src_or_dst),
588     ROP2(cirrus_fill_notsrc_or_notdst),
589     ROP2(cirrus_fill_src_notxor_dst),
590     ROP2(cirrus_fill_src_or_notdst),
591     ROP2(cirrus_fill_notsrc),
592     ROP2(cirrus_fill_notsrc_or_dst),
593     ROP2(cirrus_fill_notsrc_and_notdst),
594 };
595 
596 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
597 {
598     unsigned int color;
599     switch (s->cirrus_blt_pixelwidth) {
600     case 1:
601         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
602         break;
603     case 2:
604         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
605         s->cirrus_blt_fgcol = le16_to_cpu(color);
606         break;
607     case 3:
608         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
609             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
610         break;
611     default:
612     case 4:
613         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
614             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
615         s->cirrus_blt_fgcol = le32_to_cpu(color);
616         break;
617     }
618 }
619 
620 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
621 {
622     unsigned int color;
623     switch (s->cirrus_blt_pixelwidth) {
624     case 1:
625         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
626         break;
627     case 2:
628         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
629         s->cirrus_blt_bgcol = le16_to_cpu(color);
630         break;
631     case 3:
632         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
633             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
634         break;
635     default:
636     case 4:
637         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
638             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
639         s->cirrus_blt_bgcol = le32_to_cpu(color);
640         break;
641     }
642 }
643 
644 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
645 				     int off_pitch, int bytesperline,
646 				     int lines)
647 {
648     int y;
649     int off_cur;
650     int off_cur_end;
651 
652     for (y = 0; y < lines; y++) {
653 	off_cur = off_begin;
654 	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
655         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
656 	off_begin += off_pitch;
657     }
658 }
659 
660 static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
661 					    const uint8_t * src)
662 {
663     uint8_t *dst;
664 
665     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
666 
667     if (blit_is_unsafe(s))
668         return 0;
669 
670     (*s->cirrus_rop) (s, dst, src,
671                       s->cirrus_blt_dstpitch, 0,
672                       s->cirrus_blt_width, s->cirrus_blt_height);
673     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
674                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
675                              s->cirrus_blt_height);
676     return 1;
677 }
678 
679 /* fill */
680 
681 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
682 {
683     cirrus_fill_t rop_func;
684 
685     if (blit_is_unsafe(s)) {
686         return 0;
687     }
688     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
689     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
690              s->cirrus_blt_dstpitch,
691              s->cirrus_blt_width, s->cirrus_blt_height);
692     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
693 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
694 			     s->cirrus_blt_height);
695     cirrus_bitblt_reset(s);
696     return 1;
697 }
698 
699 /***************************************
700  *
701  *  bitblt (video-to-video)
702  *
703  ***************************************/
704 
705 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
706 {
707     return cirrus_bitblt_common_patterncopy(s,
708 					    s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
709                                             s->cirrus_addr_mask));
710 }
711 
712 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
713 {
714     int sx = 0, sy = 0;
715     int dx = 0, dy = 0;
716     int depth = 0;
717     int notify = 0;
718 
719     /* make sure to only copy if it's a plain copy ROP */
720     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
721         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
722 
723         int width, height;
724 
725         depth = s->vga.get_bpp(&s->vga) / 8;
726         s->vga.get_resolution(&s->vga, &width, &height);
727 
728         /* extra x, y */
729         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
730         sy = (src / ABS(s->cirrus_blt_srcpitch));
731         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
732         dy = (dst / ABS(s->cirrus_blt_dstpitch));
733 
734         /* normalize width */
735         w /= depth;
736 
737         /* if we're doing a backward copy, we have to adjust
738            our x/y to be the upper left corner (instead of the lower
739            right corner) */
740         if (s->cirrus_blt_dstpitch < 0) {
741             sx -= (s->cirrus_blt_width / depth) - 1;
742             dx -= (s->cirrus_blt_width / depth) - 1;
743             sy -= s->cirrus_blt_height - 1;
744             dy -= s->cirrus_blt_height - 1;
745         }
746 
747         /* are we in the visible portion of memory? */
748         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
749             (sx + w) <= width && (sy + h) <= height &&
750             (dx + w) <= width && (dy + h) <= height) {
751             notify = 1;
752         }
753     }
754 
755     /* we have to flush all pending changes so that the copy
756        is generated at the appropriate moment in time */
757     if (notify)
758         graphic_hw_update(s->vga.con);
759 
760     (*s->cirrus_rop) (s, s->vga.vram_ptr +
761 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
762 		      s->vga.vram_ptr +
763 		      (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
764 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
765 		      s->cirrus_blt_width, s->cirrus_blt_height);
766 
767     if (notify) {
768         qemu_console_copy(s->vga.con,
769 			  sx, sy, dx, dy,
770 			  s->cirrus_blt_width / depth,
771 			  s->cirrus_blt_height);
772     }
773 
774     /* we don't have to notify the display that this portion has
775        changed since qemu_console_copy implies this */
776 
777     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
778 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
779 				s->cirrus_blt_height);
780 }
781 
782 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
783 {
784     if (blit_is_unsafe(s))
785         return 0;
786 
787     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
788             s->cirrus_blt_srcaddr - s->vga.start_addr,
789             s->cirrus_blt_width, s->cirrus_blt_height);
790 
791     return 1;
792 }
793 
794 /***************************************
795  *
796  *  bitblt (cpu-to-video)
797  *
798  ***************************************/
799 
800 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
801 {
802     int copy_count;
803     uint8_t *end_ptr;
804 
805     if (s->cirrus_srccounter > 0) {
806         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
807             cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);
808         the_end:
809             s->cirrus_srccounter = 0;
810             cirrus_bitblt_reset(s);
811         } else {
812             /* at least one scan line */
813             do {
814                 (*s->cirrus_rop)(s, s->vga.vram_ptr +
815                                  (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
816                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
817                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
818                                          s->cirrus_blt_width, 1);
819                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
820                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
821                 if (s->cirrus_srccounter <= 0)
822                     goto the_end;
823                 /* more bytes than needed can be transferred because of
824                    word alignment, so we keep them for the next line */
825                 /* XXX: keep alignment to speed up transfer */
826                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
827                 copy_count = s->cirrus_srcptr_end - end_ptr;
828                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
829                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
830                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
831             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
832         }
833     }
834 }
835 
836 /***************************************
837  *
838  *  bitblt wrapper
839  *
840  ***************************************/
841 
842 static void cirrus_bitblt_reset(CirrusVGAState * s)
843 {
844     int need_update;
845 
846     s->vga.gr[0x31] &=
847 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
848     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
849         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
850     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
851     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
852     s->cirrus_srccounter = 0;
853     if (!need_update)
854         return;
855     cirrus_update_memory_access(s);
856 }
857 
858 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
859 {
860     int w;
861 
862     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
863     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
864     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
865 
866     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
867 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
868 	    s->cirrus_blt_srcpitch = 8;
869 	} else {
870             /* XXX: check for 24 bpp */
871 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
872 	}
873 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
874     } else {
875 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
876             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
877             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
878                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
879             else
880                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
881 	} else {
882             /* always align input size to 32 bits */
883 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
884 	}
885         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
886     }
887     s->cirrus_srcptr = s->cirrus_bltbuf;
888     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
889     cirrus_update_memory_access(s);
890     return 1;
891 }
892 
893 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
894 {
895     /* XXX */
896 #ifdef DEBUG_BITBLT
897     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
898 #endif
899     return 0;
900 }
901 
902 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
903 {
904     int ret;
905 
906     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
907 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
908     } else {
909 	ret = cirrus_bitblt_videotovideo_copy(s);
910     }
911     if (ret)
912 	cirrus_bitblt_reset(s);
913     return ret;
914 }
915 
916 static void cirrus_bitblt_start(CirrusVGAState * s)
917 {
918     uint8_t blt_rop;
919 
920     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
921 
922     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
923     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
924     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
925     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
926     s->cirrus_blt_dstaddr =
927 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
928     s->cirrus_blt_srcaddr =
929 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
930     s->cirrus_blt_mode = s->vga.gr[0x30];
931     s->cirrus_blt_modeext = s->vga.gr[0x33];
932     blt_rop = s->vga.gr[0x32];
933 
934 #ifdef DEBUG_BITBLT
935     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
936            blt_rop,
937            s->cirrus_blt_mode,
938            s->cirrus_blt_modeext,
939            s->cirrus_blt_width,
940            s->cirrus_blt_height,
941            s->cirrus_blt_dstpitch,
942            s->cirrus_blt_srcpitch,
943            s->cirrus_blt_dstaddr,
944            s->cirrus_blt_srcaddr,
945            s->vga.gr[0x2f]);
946 #endif
947 
948     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
949     case CIRRUS_BLTMODE_PIXELWIDTH8:
950 	s->cirrus_blt_pixelwidth = 1;
951 	break;
952     case CIRRUS_BLTMODE_PIXELWIDTH16:
953 	s->cirrus_blt_pixelwidth = 2;
954 	break;
955     case CIRRUS_BLTMODE_PIXELWIDTH24:
956 	s->cirrus_blt_pixelwidth = 3;
957 	break;
958     case CIRRUS_BLTMODE_PIXELWIDTH32:
959 	s->cirrus_blt_pixelwidth = 4;
960 	break;
961     default:
962 #ifdef DEBUG_BITBLT
963 	printf("cirrus: bitblt - pixel width is unknown\n");
964 #endif
965 	goto bitblt_ignore;
966     }
967     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
968 
969     if ((s->
970 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
971 			    CIRRUS_BLTMODE_MEMSYSDEST))
972 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
973 #ifdef DEBUG_BITBLT
974 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
975 #endif
976 	goto bitblt_ignore;
977     }
978 
979     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
980         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
981                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
982                                CIRRUS_BLTMODE_PATTERNCOPY |
983                                CIRRUS_BLTMODE_COLOREXPAND)) ==
984          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
985         cirrus_bitblt_fgcol(s);
986         cirrus_bitblt_solidfill(s, blt_rop);
987     } else {
988         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
989                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
990             CIRRUS_BLTMODE_COLOREXPAND) {
991 
992             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
993                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
994                     cirrus_bitblt_bgcol(s);
995                 else
996                     cirrus_bitblt_fgcol(s);
997                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
998             } else {
999                 cirrus_bitblt_fgcol(s);
1000                 cirrus_bitblt_bgcol(s);
1001                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1002             }
1003         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1004             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1005                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1006                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1007                         cirrus_bitblt_bgcol(s);
1008                     else
1009                         cirrus_bitblt_fgcol(s);
1010                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1011                 } else {
1012                     cirrus_bitblt_fgcol(s);
1013                     cirrus_bitblt_bgcol(s);
1014                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1015                 }
1016             } else {
1017                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1018             }
1019         } else {
1020 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1021 		if (s->cirrus_blt_pixelwidth > 2) {
1022 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1023 		    goto bitblt_ignore;
1024 		}
1025 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1026 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1027 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1028 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1029 		} else {
1030 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1031 		}
1032 	    } else {
1033 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1034 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1035 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1036 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1037 		} else {
1038 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1039 		}
1040 	    }
1041 	}
1042         // setup bitblt engine.
1043         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1044             if (!cirrus_bitblt_cputovideo(s))
1045                 goto bitblt_ignore;
1046         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1047             if (!cirrus_bitblt_videotocpu(s))
1048                 goto bitblt_ignore;
1049         } else {
1050             if (!cirrus_bitblt_videotovideo(s))
1051                 goto bitblt_ignore;
1052         }
1053     }
1054     return;
1055   bitblt_ignore:;
1056     cirrus_bitblt_reset(s);
1057 }
1058 
1059 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1060 {
1061     unsigned old_value;
1062 
1063     old_value = s->vga.gr[0x31];
1064     s->vga.gr[0x31] = reg_value;
1065 
1066     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1067 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1068 	cirrus_bitblt_reset(s);
1069     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1070 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1071 	cirrus_bitblt_start(s);
1072     }
1073 }
1074 
1075 
1076 /***************************************
1077  *
1078  *  basic parameters
1079  *
1080  ***************************************/
1081 
1082 static void cirrus_get_offsets(VGACommonState *s1,
1083                                uint32_t *pline_offset,
1084                                uint32_t *pstart_addr,
1085                                uint32_t *pline_compare)
1086 {
1087     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1088     uint32_t start_addr, line_offset, line_compare;
1089 
1090     line_offset = s->vga.cr[0x13]
1091 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1092     line_offset <<= 3;
1093     *pline_offset = line_offset;
1094 
1095     start_addr = (s->vga.cr[0x0c] << 8)
1096 	| s->vga.cr[0x0d]
1097 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1098 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1099 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1100     *pstart_addr = start_addr;
1101 
1102     line_compare = s->vga.cr[0x18] |
1103         ((s->vga.cr[0x07] & 0x10) << 4) |
1104         ((s->vga.cr[0x09] & 0x40) << 3);
1105     *pline_compare = line_compare;
1106 }
1107 
1108 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1109 {
1110     uint32_t ret = 16;
1111 
1112     switch (s->cirrus_hidden_dac_data & 0xf) {
1113     case 0:
1114 	ret = 15;
1115 	break;			/* Sierra HiColor */
1116     case 1:
1117 	ret = 16;
1118 	break;			/* XGA HiColor */
1119     default:
1120 #ifdef DEBUG_CIRRUS
1121 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1122 	       (s->cirrus_hidden_dac_data & 0xf));
1123 #endif
1124 	ret = 15;		/* XXX */
1125 	break;
1126     }
1127     return ret;
1128 }
1129 
1130 static int cirrus_get_bpp(VGACommonState *s1)
1131 {
1132     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1133     uint32_t ret = 8;
1134 
1135     if ((s->vga.sr[0x07] & 0x01) != 0) {
1136 	/* Cirrus SVGA */
1137 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1138 	case CIRRUS_SR7_BPP_8:
1139 	    ret = 8;
1140 	    break;
1141 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1142 	    ret = cirrus_get_bpp16_depth(s);
1143 	    break;
1144 	case CIRRUS_SR7_BPP_24:
1145 	    ret = 24;
1146 	    break;
1147 	case CIRRUS_SR7_BPP_16:
1148 	    ret = cirrus_get_bpp16_depth(s);
1149 	    break;
1150 	case CIRRUS_SR7_BPP_32:
1151 	    ret = 32;
1152 	    break;
1153 	default:
1154 #ifdef DEBUG_CIRRUS
1155 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1156 #endif
1157 	    ret = 8;
1158 	    break;
1159 	}
1160     } else {
1161 	/* VGA */
1162 	ret = 0;
1163     }
1164 
1165     return ret;
1166 }
1167 
1168 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1169 {
1170     int width, height;
1171 
1172     width = (s->cr[0x01] + 1) * 8;
1173     height = s->cr[0x12] |
1174         ((s->cr[0x07] & 0x02) << 7) |
1175         ((s->cr[0x07] & 0x40) << 3);
1176     height = (height + 1);
1177     /* interlace support */
1178     if (s->cr[0x1a] & 0x01)
1179         height = height * 2;
1180     *pwidth = width;
1181     *pheight = height;
1182 }
1183 
1184 /***************************************
1185  *
1186  * bank memory
1187  *
1188  ***************************************/
1189 
1190 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1191 {
1192     unsigned offset;
1193     unsigned limit;
1194 
1195     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1196 	offset = s->vga.gr[0x09 + bank_index];
1197     else			/* single bank */
1198 	offset = s->vga.gr[0x09];
1199 
1200     if ((s->vga.gr[0x0b] & 0x20) != 0)
1201 	offset <<= 14;
1202     else
1203 	offset <<= 12;
1204 
1205     if (s->real_vram_size <= offset)
1206 	limit = 0;
1207     else
1208 	limit = s->real_vram_size - offset;
1209 
1210     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1211 	if (limit > 0x8000) {
1212 	    offset += 0x8000;
1213 	    limit -= 0x8000;
1214 	} else {
1215 	    limit = 0;
1216 	}
1217     }
1218 
1219     if (limit > 0) {
1220 	s->cirrus_bank_base[bank_index] = offset;
1221 	s->cirrus_bank_limit[bank_index] = limit;
1222     } else {
1223 	s->cirrus_bank_base[bank_index] = 0;
1224 	s->cirrus_bank_limit[bank_index] = 0;
1225     }
1226 }
1227 
1228 /***************************************
1229  *
1230  *  I/O access between 0x3c4-0x3c5
1231  *
1232  ***************************************/
1233 
1234 static int cirrus_vga_read_sr(CirrusVGAState * s)
1235 {
1236     switch (s->vga.sr_index) {
1237     case 0x00:			// Standard VGA
1238     case 0x01:			// Standard VGA
1239     case 0x02:			// Standard VGA
1240     case 0x03:			// Standard VGA
1241     case 0x04:			// Standard VGA
1242 	return s->vga.sr[s->vga.sr_index];
1243     case 0x06:			// Unlock Cirrus extensions
1244 	return s->vga.sr[s->vga.sr_index];
1245     case 0x10:
1246     case 0x30:
1247     case 0x50:
1248     case 0x70:			// Graphics Cursor X
1249     case 0x90:
1250     case 0xb0:
1251     case 0xd0:
1252     case 0xf0:			// Graphics Cursor X
1253 	return s->vga.sr[0x10];
1254     case 0x11:
1255     case 0x31:
1256     case 0x51:
1257     case 0x71:			// Graphics Cursor Y
1258     case 0x91:
1259     case 0xb1:
1260     case 0xd1:
1261     case 0xf1:			// Graphics Cursor Y
1262 	return s->vga.sr[0x11];
1263     case 0x05:			// ???
1264     case 0x07:			// Extended Sequencer Mode
1265     case 0x08:			// EEPROM Control
1266     case 0x09:			// Scratch Register 0
1267     case 0x0a:			// Scratch Register 1
1268     case 0x0b:			// VCLK 0
1269     case 0x0c:			// VCLK 1
1270     case 0x0d:			// VCLK 2
1271     case 0x0e:			// VCLK 3
1272     case 0x0f:			// DRAM Control
1273     case 0x12:			// Graphics Cursor Attribute
1274     case 0x13:			// Graphics Cursor Pattern Address
1275     case 0x14:			// Scratch Register 2
1276     case 0x15:			// Scratch Register 3
1277     case 0x16:			// Performance Tuning Register
1278     case 0x17:			// Configuration Readback and Extended Control
1279     case 0x18:			// Signature Generator Control
1280     case 0x19:			// Signal Generator Result
1281     case 0x1a:			// Signal Generator Result
1282     case 0x1b:			// VCLK 0 Denominator & Post
1283     case 0x1c:			// VCLK 1 Denominator & Post
1284     case 0x1d:			// VCLK 2 Denominator & Post
1285     case 0x1e:			// VCLK 3 Denominator & Post
1286     case 0x1f:			// BIOS Write Enable and MCLK select
1287 #ifdef DEBUG_CIRRUS
1288 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1289 #endif
1290 	return s->vga.sr[s->vga.sr_index];
1291     default:
1292 #ifdef DEBUG_CIRRUS
1293 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1294 #endif
1295 	return 0xff;
1296 	break;
1297     }
1298 }
1299 
1300 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1301 {
1302     switch (s->vga.sr_index) {
1303     case 0x00:			// Standard VGA
1304     case 0x01:			// Standard VGA
1305     case 0x02:			// Standard VGA
1306     case 0x03:			// Standard VGA
1307     case 0x04:			// Standard VGA
1308 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1309 	if (s->vga.sr_index == 1)
1310             s->vga.update_retrace_info(&s->vga);
1311         break;
1312     case 0x06:			// Unlock Cirrus extensions
1313 	val &= 0x17;
1314 	if (val == 0x12) {
1315 	    s->vga.sr[s->vga.sr_index] = 0x12;
1316 	} else {
1317 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1318 	}
1319 	break;
1320     case 0x10:
1321     case 0x30:
1322     case 0x50:
1323     case 0x70:			// Graphics Cursor X
1324     case 0x90:
1325     case 0xb0:
1326     case 0xd0:
1327     case 0xf0:			// Graphics Cursor X
1328 	s->vga.sr[0x10] = val;
1329         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1330 	break;
1331     case 0x11:
1332     case 0x31:
1333     case 0x51:
1334     case 0x71:			// Graphics Cursor Y
1335     case 0x91:
1336     case 0xb1:
1337     case 0xd1:
1338     case 0xf1:			// Graphics Cursor Y
1339 	s->vga.sr[0x11] = val;
1340         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1341 	break;
1342     case 0x07:			// Extended Sequencer Mode
1343     cirrus_update_memory_access(s);
1344     case 0x08:			// EEPROM Control
1345     case 0x09:			// Scratch Register 0
1346     case 0x0a:			// Scratch Register 1
1347     case 0x0b:			// VCLK 0
1348     case 0x0c:			// VCLK 1
1349     case 0x0d:			// VCLK 2
1350     case 0x0e:			// VCLK 3
1351     case 0x0f:			// DRAM Control
1352     case 0x13:			// Graphics Cursor Pattern Address
1353     case 0x14:			// Scratch Register 2
1354     case 0x15:			// Scratch Register 3
1355     case 0x16:			// Performance Tuning Register
1356     case 0x18:			// Signature Generator Control
1357     case 0x19:			// Signature Generator Result
1358     case 0x1a:			// Signature Generator Result
1359     case 0x1b:			// VCLK 0 Denominator & Post
1360     case 0x1c:			// VCLK 1 Denominator & Post
1361     case 0x1d:			// VCLK 2 Denominator & Post
1362     case 0x1e:			// VCLK 3 Denominator & Post
1363     case 0x1f:			// BIOS Write Enable and MCLK select
1364 	s->vga.sr[s->vga.sr_index] = val;
1365 #ifdef DEBUG_CIRRUS
1366 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1367 	       s->vga.sr_index, val);
1368 #endif
1369 	break;
1370     case 0x12:			// Graphics Cursor Attribute
1371 	s->vga.sr[0x12] = val;
1372         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1373 #ifdef DEBUG_CIRRUS
1374         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1375                val, s->vga.force_shadow);
1376 #endif
1377         break;
1378     case 0x17:			// Configuration Readback and Extended Control
1379 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1380                                    | (val & 0xc7);
1381         cirrus_update_memory_access(s);
1382         break;
1383     default:
1384 #ifdef DEBUG_CIRRUS
1385 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1386                s->vga.sr_index, val);
1387 #endif
1388 	break;
1389     }
1390 }
1391 
1392 /***************************************
1393  *
1394  *  I/O access at 0x3c6
1395  *
1396  ***************************************/
1397 
1398 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1399 {
1400     if (++s->cirrus_hidden_dac_lockindex == 5) {
1401         s->cirrus_hidden_dac_lockindex = 0;
1402         return s->cirrus_hidden_dac_data;
1403     }
1404     return 0xff;
1405 }
1406 
1407 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1408 {
1409     if (s->cirrus_hidden_dac_lockindex == 4) {
1410 	s->cirrus_hidden_dac_data = reg_value;
1411 #if defined(DEBUG_CIRRUS)
1412 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1413 #endif
1414     }
1415     s->cirrus_hidden_dac_lockindex = 0;
1416 }
1417 
1418 /***************************************
1419  *
1420  *  I/O access at 0x3c9
1421  *
1422  ***************************************/
1423 
1424 static int cirrus_vga_read_palette(CirrusVGAState * s)
1425 {
1426     int val;
1427 
1428     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1429         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1430                                        s->vga.dac_sub_index];
1431     } else {
1432         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1433     }
1434     if (++s->vga.dac_sub_index == 3) {
1435 	s->vga.dac_sub_index = 0;
1436 	s->vga.dac_read_index++;
1437     }
1438     return val;
1439 }
1440 
1441 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1442 {
1443     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1444     if (++s->vga.dac_sub_index == 3) {
1445         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1446             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1447                    s->vga.dac_cache, 3);
1448         } else {
1449             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1450         }
1451         /* XXX update cursor */
1452 	s->vga.dac_sub_index = 0;
1453 	s->vga.dac_write_index++;
1454     }
1455 }
1456 
1457 /***************************************
1458  *
1459  *  I/O access between 0x3ce-0x3cf
1460  *
1461  ***************************************/
1462 
1463 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1464 {
1465     switch (reg_index) {
1466     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1467         return s->cirrus_shadow_gr0;
1468     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1469         return s->cirrus_shadow_gr1;
1470     case 0x02:			// Standard VGA
1471     case 0x03:			// Standard VGA
1472     case 0x04:			// Standard VGA
1473     case 0x06:			// Standard VGA
1474     case 0x07:			// Standard VGA
1475     case 0x08:			// Standard VGA
1476         return s->vga.gr[s->vga.gr_index];
1477     case 0x05:			// Standard VGA, Cirrus extended mode
1478     default:
1479 	break;
1480     }
1481 
1482     if (reg_index < 0x3a) {
1483 	return s->vga.gr[reg_index];
1484     } else {
1485 #ifdef DEBUG_CIRRUS
1486 	printf("cirrus: inport gr_index %02x\n", reg_index);
1487 #endif
1488 	return 0xff;
1489     }
1490 }
1491 
1492 static void
1493 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1494 {
1495 #if defined(DEBUG_BITBLT) && 0
1496     printf("gr%02x: %02x\n", reg_index, reg_value);
1497 #endif
1498     switch (reg_index) {
1499     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1500 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1501 	s->cirrus_shadow_gr0 = reg_value;
1502 	break;
1503     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1504 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1505 	s->cirrus_shadow_gr1 = reg_value;
1506 	break;
1507     case 0x02:			// Standard VGA
1508     case 0x03:			// Standard VGA
1509     case 0x04:			// Standard VGA
1510     case 0x06:			// Standard VGA
1511     case 0x07:			// Standard VGA
1512     case 0x08:			// Standard VGA
1513 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1514         break;
1515     case 0x05:			// Standard VGA, Cirrus extended mode
1516 	s->vga.gr[reg_index] = reg_value & 0x7f;
1517         cirrus_update_memory_access(s);
1518 	break;
1519     case 0x09:			// bank offset #0
1520     case 0x0A:			// bank offset #1
1521 	s->vga.gr[reg_index] = reg_value;
1522 	cirrus_update_bank_ptr(s, 0);
1523 	cirrus_update_bank_ptr(s, 1);
1524         cirrus_update_memory_access(s);
1525         break;
1526     case 0x0B:
1527 	s->vga.gr[reg_index] = reg_value;
1528 	cirrus_update_bank_ptr(s, 0);
1529 	cirrus_update_bank_ptr(s, 1);
1530         cirrus_update_memory_access(s);
1531 	break;
1532     case 0x10:			// BGCOLOR 0x0000ff00
1533     case 0x11:			// FGCOLOR 0x0000ff00
1534     case 0x12:			// BGCOLOR 0x00ff0000
1535     case 0x13:			// FGCOLOR 0x00ff0000
1536     case 0x14:			// BGCOLOR 0xff000000
1537     case 0x15:			// FGCOLOR 0xff000000
1538     case 0x20:			// BLT WIDTH 0x0000ff
1539     case 0x22:			// BLT HEIGHT 0x0000ff
1540     case 0x24:			// BLT DEST PITCH 0x0000ff
1541     case 0x26:			// BLT SRC PITCH 0x0000ff
1542     case 0x28:			// BLT DEST ADDR 0x0000ff
1543     case 0x29:			// BLT DEST ADDR 0x00ff00
1544     case 0x2c:			// BLT SRC ADDR 0x0000ff
1545     case 0x2d:			// BLT SRC ADDR 0x00ff00
1546     case 0x2f:                  // BLT WRITEMASK
1547     case 0x30:			// BLT MODE
1548     case 0x32:			// RASTER OP
1549     case 0x33:			// BLT MODEEXT
1550     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1551     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1552     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1553     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1554 	s->vga.gr[reg_index] = reg_value;
1555 	break;
1556     case 0x21:			// BLT WIDTH 0x001f00
1557     case 0x23:			// BLT HEIGHT 0x001f00
1558     case 0x25:			// BLT DEST PITCH 0x001f00
1559     case 0x27:			// BLT SRC PITCH 0x001f00
1560 	s->vga.gr[reg_index] = reg_value & 0x1f;
1561 	break;
1562     case 0x2a:			// BLT DEST ADDR 0x3f0000
1563 	s->vga.gr[reg_index] = reg_value & 0x3f;
1564         /* if auto start mode, starts bit blt now */
1565         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1566             cirrus_bitblt_start(s);
1567         }
1568 	break;
1569     case 0x2e:			// BLT SRC ADDR 0x3f0000
1570 	s->vga.gr[reg_index] = reg_value & 0x3f;
1571 	break;
1572     case 0x31:			// BLT STATUS/START
1573 	cirrus_write_bitblt(s, reg_value);
1574 	break;
1575     default:
1576 #ifdef DEBUG_CIRRUS
1577 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1578 	       reg_value);
1579 #endif
1580 	break;
1581     }
1582 }
1583 
1584 /***************************************
1585  *
1586  *  I/O access between 0x3d4-0x3d5
1587  *
1588  ***************************************/
1589 
1590 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1591 {
1592     switch (reg_index) {
1593     case 0x00:			// Standard VGA
1594     case 0x01:			// Standard VGA
1595     case 0x02:			// Standard VGA
1596     case 0x03:			// Standard VGA
1597     case 0x04:			// Standard VGA
1598     case 0x05:			// Standard VGA
1599     case 0x06:			// Standard VGA
1600     case 0x07:			// Standard VGA
1601     case 0x08:			// Standard VGA
1602     case 0x09:			// Standard VGA
1603     case 0x0a:			// Standard VGA
1604     case 0x0b:			// Standard VGA
1605     case 0x0c:			// Standard VGA
1606     case 0x0d:			// Standard VGA
1607     case 0x0e:			// Standard VGA
1608     case 0x0f:			// Standard VGA
1609     case 0x10:			// Standard VGA
1610     case 0x11:			// Standard VGA
1611     case 0x12:			// Standard VGA
1612     case 0x13:			// Standard VGA
1613     case 0x14:			// Standard VGA
1614     case 0x15:			// Standard VGA
1615     case 0x16:			// Standard VGA
1616     case 0x17:			// Standard VGA
1617     case 0x18:			// Standard VGA
1618 	return s->vga.cr[s->vga.cr_index];
1619     case 0x24:			// Attribute Controller Toggle Readback (R)
1620         return (s->vga.ar_flip_flop << 7);
1621     case 0x19:			// Interlace End
1622     case 0x1a:			// Miscellaneous Control
1623     case 0x1b:			// Extended Display Control
1624     case 0x1c:			// Sync Adjust and Genlock
1625     case 0x1d:			// Overlay Extended Control
1626     case 0x22:			// Graphics Data Latches Readback (R)
1627     case 0x25:			// Part Status
1628     case 0x27:			// Part ID (R)
1629 	return s->vga.cr[s->vga.cr_index];
1630     case 0x26:			// Attribute Controller Index Readback (R)
1631 	return s->vga.ar_index & 0x3f;
1632 	break;
1633     default:
1634 #ifdef DEBUG_CIRRUS
1635 	printf("cirrus: inport cr_index %02x\n", reg_index);
1636 #endif
1637 	return 0xff;
1638     }
1639 }
1640 
1641 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1642 {
1643     switch (s->vga.cr_index) {
1644     case 0x00:			// Standard VGA
1645     case 0x01:			// Standard VGA
1646     case 0x02:			// Standard VGA
1647     case 0x03:			// Standard VGA
1648     case 0x04:			// Standard VGA
1649     case 0x05:			// Standard VGA
1650     case 0x06:			// Standard VGA
1651     case 0x07:			// Standard VGA
1652     case 0x08:			// Standard VGA
1653     case 0x09:			// Standard VGA
1654     case 0x0a:			// Standard VGA
1655     case 0x0b:			// Standard VGA
1656     case 0x0c:			// Standard VGA
1657     case 0x0d:			// Standard VGA
1658     case 0x0e:			// Standard VGA
1659     case 0x0f:			// Standard VGA
1660     case 0x10:			// Standard VGA
1661     case 0x11:			// Standard VGA
1662     case 0x12:			// Standard VGA
1663     case 0x13:			// Standard VGA
1664     case 0x14:			// Standard VGA
1665     case 0x15:			// Standard VGA
1666     case 0x16:			// Standard VGA
1667     case 0x17:			// Standard VGA
1668     case 0x18:			// Standard VGA
1669 	/* handle CR0-7 protection */
1670 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1671 	    /* can always write bit 4 of CR7 */
1672 	    if (s->vga.cr_index == 7)
1673 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1674 	    return;
1675 	}
1676 	s->vga.cr[s->vga.cr_index] = reg_value;
1677 	switch(s->vga.cr_index) {
1678 	case 0x00:
1679 	case 0x04:
1680 	case 0x05:
1681 	case 0x06:
1682 	case 0x07:
1683 	case 0x11:
1684 	case 0x17:
1685 	    s->vga.update_retrace_info(&s->vga);
1686 	    break;
1687 	}
1688         break;
1689     case 0x19:			// Interlace End
1690     case 0x1a:			// Miscellaneous Control
1691     case 0x1b:			// Extended Display Control
1692     case 0x1c:			// Sync Adjust and Genlock
1693     case 0x1d:			// Overlay Extended Control
1694 	s->vga.cr[s->vga.cr_index] = reg_value;
1695 #ifdef DEBUG_CIRRUS
1696 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1697 	       s->vga.cr_index, reg_value);
1698 #endif
1699 	break;
1700     case 0x22:			// Graphics Data Latches Readback (R)
1701     case 0x24:			// Attribute Controller Toggle Readback (R)
1702     case 0x26:			// Attribute Controller Index Readback (R)
1703     case 0x27:			// Part ID (R)
1704 	break;
1705     case 0x25:			// Part Status
1706     default:
1707 #ifdef DEBUG_CIRRUS
1708 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1709                s->vga.cr_index, reg_value);
1710 #endif
1711 	break;
1712     }
1713 }
1714 
1715 /***************************************
1716  *
1717  *  memory-mapped I/O (bitblt)
1718  *
1719  ***************************************/
1720 
1721 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1722 {
1723     int value = 0xff;
1724 
1725     switch (address) {
1726     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1727 	value = cirrus_vga_read_gr(s, 0x00);
1728 	break;
1729     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1730 	value = cirrus_vga_read_gr(s, 0x10);
1731 	break;
1732     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1733 	value = cirrus_vga_read_gr(s, 0x12);
1734 	break;
1735     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1736 	value = cirrus_vga_read_gr(s, 0x14);
1737 	break;
1738     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1739 	value = cirrus_vga_read_gr(s, 0x01);
1740 	break;
1741     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1742 	value = cirrus_vga_read_gr(s, 0x11);
1743 	break;
1744     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1745 	value = cirrus_vga_read_gr(s, 0x13);
1746 	break;
1747     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1748 	value = cirrus_vga_read_gr(s, 0x15);
1749 	break;
1750     case (CIRRUS_MMIO_BLTWIDTH + 0):
1751 	value = cirrus_vga_read_gr(s, 0x20);
1752 	break;
1753     case (CIRRUS_MMIO_BLTWIDTH + 1):
1754 	value = cirrus_vga_read_gr(s, 0x21);
1755 	break;
1756     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1757 	value = cirrus_vga_read_gr(s, 0x22);
1758 	break;
1759     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1760 	value = cirrus_vga_read_gr(s, 0x23);
1761 	break;
1762     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1763 	value = cirrus_vga_read_gr(s, 0x24);
1764 	break;
1765     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1766 	value = cirrus_vga_read_gr(s, 0x25);
1767 	break;
1768     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1769 	value = cirrus_vga_read_gr(s, 0x26);
1770 	break;
1771     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1772 	value = cirrus_vga_read_gr(s, 0x27);
1773 	break;
1774     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1775 	value = cirrus_vga_read_gr(s, 0x28);
1776 	break;
1777     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1778 	value = cirrus_vga_read_gr(s, 0x29);
1779 	break;
1780     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1781 	value = cirrus_vga_read_gr(s, 0x2a);
1782 	break;
1783     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1784 	value = cirrus_vga_read_gr(s, 0x2c);
1785 	break;
1786     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1787 	value = cirrus_vga_read_gr(s, 0x2d);
1788 	break;
1789     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1790 	value = cirrus_vga_read_gr(s, 0x2e);
1791 	break;
1792     case CIRRUS_MMIO_BLTWRITEMASK:
1793 	value = cirrus_vga_read_gr(s, 0x2f);
1794 	break;
1795     case CIRRUS_MMIO_BLTMODE:
1796 	value = cirrus_vga_read_gr(s, 0x30);
1797 	break;
1798     case CIRRUS_MMIO_BLTROP:
1799 	value = cirrus_vga_read_gr(s, 0x32);
1800 	break;
1801     case CIRRUS_MMIO_BLTMODEEXT:
1802 	value = cirrus_vga_read_gr(s, 0x33);
1803 	break;
1804     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1805 	value = cirrus_vga_read_gr(s, 0x34);
1806 	break;
1807     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1808 	value = cirrus_vga_read_gr(s, 0x35);
1809 	break;
1810     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1811 	value = cirrus_vga_read_gr(s, 0x38);
1812 	break;
1813     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1814 	value = cirrus_vga_read_gr(s, 0x39);
1815 	break;
1816     case CIRRUS_MMIO_BLTSTATUS:
1817 	value = cirrus_vga_read_gr(s, 0x31);
1818 	break;
1819     default:
1820 #ifdef DEBUG_CIRRUS
1821 	printf("cirrus: mmio read - address 0x%04x\n", address);
1822 #endif
1823 	break;
1824     }
1825 
1826     return (uint8_t) value;
1827 }
1828 
1829 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1830 				  uint8_t value)
1831 {
1832     switch (address) {
1833     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1834 	cirrus_vga_write_gr(s, 0x00, value);
1835 	break;
1836     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1837 	cirrus_vga_write_gr(s, 0x10, value);
1838 	break;
1839     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1840 	cirrus_vga_write_gr(s, 0x12, value);
1841 	break;
1842     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1843 	cirrus_vga_write_gr(s, 0x14, value);
1844 	break;
1845     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1846 	cirrus_vga_write_gr(s, 0x01, value);
1847 	break;
1848     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1849 	cirrus_vga_write_gr(s, 0x11, value);
1850 	break;
1851     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1852 	cirrus_vga_write_gr(s, 0x13, value);
1853 	break;
1854     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1855 	cirrus_vga_write_gr(s, 0x15, value);
1856 	break;
1857     case (CIRRUS_MMIO_BLTWIDTH + 0):
1858 	cirrus_vga_write_gr(s, 0x20, value);
1859 	break;
1860     case (CIRRUS_MMIO_BLTWIDTH + 1):
1861 	cirrus_vga_write_gr(s, 0x21, value);
1862 	break;
1863     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1864 	cirrus_vga_write_gr(s, 0x22, value);
1865 	break;
1866     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1867 	cirrus_vga_write_gr(s, 0x23, value);
1868 	break;
1869     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1870 	cirrus_vga_write_gr(s, 0x24, value);
1871 	break;
1872     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1873 	cirrus_vga_write_gr(s, 0x25, value);
1874 	break;
1875     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1876 	cirrus_vga_write_gr(s, 0x26, value);
1877 	break;
1878     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1879 	cirrus_vga_write_gr(s, 0x27, value);
1880 	break;
1881     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1882 	cirrus_vga_write_gr(s, 0x28, value);
1883 	break;
1884     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1885 	cirrus_vga_write_gr(s, 0x29, value);
1886 	break;
1887     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1888 	cirrus_vga_write_gr(s, 0x2a, value);
1889 	break;
1890     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1891 	/* ignored */
1892 	break;
1893     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1894 	cirrus_vga_write_gr(s, 0x2c, value);
1895 	break;
1896     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1897 	cirrus_vga_write_gr(s, 0x2d, value);
1898 	break;
1899     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1900 	cirrus_vga_write_gr(s, 0x2e, value);
1901 	break;
1902     case CIRRUS_MMIO_BLTWRITEMASK:
1903 	cirrus_vga_write_gr(s, 0x2f, value);
1904 	break;
1905     case CIRRUS_MMIO_BLTMODE:
1906 	cirrus_vga_write_gr(s, 0x30, value);
1907 	break;
1908     case CIRRUS_MMIO_BLTROP:
1909 	cirrus_vga_write_gr(s, 0x32, value);
1910 	break;
1911     case CIRRUS_MMIO_BLTMODEEXT:
1912 	cirrus_vga_write_gr(s, 0x33, value);
1913 	break;
1914     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1915 	cirrus_vga_write_gr(s, 0x34, value);
1916 	break;
1917     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1918 	cirrus_vga_write_gr(s, 0x35, value);
1919 	break;
1920     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1921 	cirrus_vga_write_gr(s, 0x38, value);
1922 	break;
1923     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1924 	cirrus_vga_write_gr(s, 0x39, value);
1925 	break;
1926     case CIRRUS_MMIO_BLTSTATUS:
1927 	cirrus_vga_write_gr(s, 0x31, value);
1928 	break;
1929     default:
1930 #ifdef DEBUG_CIRRUS
1931 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1932 	       address, value);
1933 #endif
1934 	break;
1935     }
1936 }
1937 
1938 /***************************************
1939  *
1940  *  write mode 4/5
1941  *
1942  ***************************************/
1943 
1944 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1945 					     unsigned mode,
1946 					     unsigned offset,
1947 					     uint32_t mem_value)
1948 {
1949     int x;
1950     unsigned val = mem_value;
1951     uint8_t *dst;
1952 
1953     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1954     for (x = 0; x < 8; x++) {
1955 	if (val & 0x80) {
1956 	    *dst = s->cirrus_shadow_gr1;
1957 	} else if (mode == 5) {
1958 	    *dst = s->cirrus_shadow_gr0;
1959 	}
1960 	val <<= 1;
1961 	dst++;
1962     }
1963     memory_region_set_dirty(&s->vga.vram, offset, 8);
1964 }
1965 
1966 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1967 					      unsigned mode,
1968 					      unsigned offset,
1969 					      uint32_t mem_value)
1970 {
1971     int x;
1972     unsigned val = mem_value;
1973     uint8_t *dst;
1974 
1975     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1976     for (x = 0; x < 8; x++) {
1977 	if (val & 0x80) {
1978 	    *dst = s->cirrus_shadow_gr1;
1979 	    *(dst + 1) = s->vga.gr[0x11];
1980 	} else if (mode == 5) {
1981 	    *dst = s->cirrus_shadow_gr0;
1982 	    *(dst + 1) = s->vga.gr[0x10];
1983 	}
1984 	val <<= 1;
1985 	dst += 2;
1986     }
1987     memory_region_set_dirty(&s->vga.vram, offset, 16);
1988 }
1989 
1990 /***************************************
1991  *
1992  *  memory access between 0xa0000-0xbffff
1993  *
1994  ***************************************/
1995 
1996 static uint64_t cirrus_vga_mem_read(void *opaque,
1997                                     hwaddr addr,
1998                                     uint32_t size)
1999 {
2000     CirrusVGAState *s = opaque;
2001     unsigned bank_index;
2002     unsigned bank_offset;
2003     uint32_t val;
2004 
2005     if ((s->vga.sr[0x07] & 0x01) == 0) {
2006         return vga_mem_readb(&s->vga, addr);
2007     }
2008 
2009     if (addr < 0x10000) {
2010 	/* XXX handle bitblt */
2011 	/* video memory */
2012 	bank_index = addr >> 15;
2013 	bank_offset = addr & 0x7fff;
2014 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2015 	    bank_offset += s->cirrus_bank_base[bank_index];
2016 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2017 		bank_offset <<= 4;
2018 	    } else if (s->vga.gr[0x0B] & 0x02) {
2019 		bank_offset <<= 3;
2020 	    }
2021 	    bank_offset &= s->cirrus_addr_mask;
2022 	    val = *(s->vga.vram_ptr + bank_offset);
2023 	} else
2024 	    val = 0xff;
2025     } else if (addr >= 0x18000 && addr < 0x18100) {
2026 	/* memory-mapped I/O */
2027 	val = 0xff;
2028 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2029 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
2030 	}
2031     } else {
2032 	val = 0xff;
2033 #ifdef DEBUG_CIRRUS
2034 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2035 #endif
2036     }
2037     return val;
2038 }
2039 
2040 static void cirrus_vga_mem_write(void *opaque,
2041                                  hwaddr addr,
2042                                  uint64_t mem_value,
2043                                  uint32_t size)
2044 {
2045     CirrusVGAState *s = opaque;
2046     unsigned bank_index;
2047     unsigned bank_offset;
2048     unsigned mode;
2049 
2050     if ((s->vga.sr[0x07] & 0x01) == 0) {
2051         vga_mem_writeb(&s->vga, addr, mem_value);
2052         return;
2053     }
2054 
2055     if (addr < 0x10000) {
2056 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2057 	    /* bitblt */
2058 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2059 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2060 		cirrus_bitblt_cputovideo_next(s);
2061 	    }
2062 	} else {
2063 	    /* video memory */
2064 	    bank_index = addr >> 15;
2065 	    bank_offset = addr & 0x7fff;
2066 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2067 		bank_offset += s->cirrus_bank_base[bank_index];
2068 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2069 		    bank_offset <<= 4;
2070 		} else if (s->vga.gr[0x0B] & 0x02) {
2071 		    bank_offset <<= 3;
2072 		}
2073 		bank_offset &= s->cirrus_addr_mask;
2074 		mode = s->vga.gr[0x05] & 0x7;
2075 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2076 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2077                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2078                                             sizeof(mem_value));
2079 		} else {
2080 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2081 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2082 							 bank_offset,
2083 							 mem_value);
2084 		    } else {
2085 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2086 							  bank_offset,
2087 							  mem_value);
2088 		    }
2089 		}
2090 	    }
2091 	}
2092     } else if (addr >= 0x18000 && addr < 0x18100) {
2093 	/* memory-mapped I/O */
2094 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2095 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2096 	}
2097     } else {
2098 #ifdef DEBUG_CIRRUS
2099         printf("cirrus: mem_writeb " TARGET_FMT_plx " value 0x%02" PRIu64 "\n", addr,
2100                mem_value);
2101 #endif
2102     }
2103 }
2104 
2105 static const MemoryRegionOps cirrus_vga_mem_ops = {
2106     .read = cirrus_vga_mem_read,
2107     .write = cirrus_vga_mem_write,
2108     .endianness = DEVICE_LITTLE_ENDIAN,
2109     .impl = {
2110         .min_access_size = 1,
2111         .max_access_size = 1,
2112     },
2113 };
2114 
2115 /***************************************
2116  *
2117  *  hardware cursor
2118  *
2119  ***************************************/
2120 
2121 static inline void invalidate_cursor1(CirrusVGAState *s)
2122 {
2123     if (s->last_hw_cursor_size) {
2124         vga_invalidate_scanlines(&s->vga,
2125                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2126                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2127     }
2128 }
2129 
2130 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2131 {
2132     const uint8_t *src;
2133     uint32_t content;
2134     int y, y_min, y_max;
2135 
2136     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2137     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2138         src += (s->vga.sr[0x13] & 0x3c) * 256;
2139         y_min = 64;
2140         y_max = -1;
2141         for(y = 0; y < 64; y++) {
2142             content = ((uint32_t *)src)[0] |
2143                 ((uint32_t *)src)[1] |
2144                 ((uint32_t *)src)[2] |
2145                 ((uint32_t *)src)[3];
2146             if (content) {
2147                 if (y < y_min)
2148                     y_min = y;
2149                 if (y > y_max)
2150                     y_max = y;
2151             }
2152             src += 16;
2153         }
2154     } else {
2155         src += (s->vga.sr[0x13] & 0x3f) * 256;
2156         y_min = 32;
2157         y_max = -1;
2158         for(y = 0; y < 32; y++) {
2159             content = ((uint32_t *)src)[0] |
2160                 ((uint32_t *)(src + 128))[0];
2161             if (content) {
2162                 if (y < y_min)
2163                     y_min = y;
2164                 if (y > y_max)
2165                     y_max = y;
2166             }
2167             src += 4;
2168         }
2169     }
2170     if (y_min > y_max) {
2171         s->last_hw_cursor_y_start = 0;
2172         s->last_hw_cursor_y_end = 0;
2173     } else {
2174         s->last_hw_cursor_y_start = y_min;
2175         s->last_hw_cursor_y_end = y_max + 1;
2176     }
2177 }
2178 
2179 /* NOTE: we do not currently handle the cursor bitmap change, so we
2180    update the cursor only if it moves. */
2181 static void cirrus_cursor_invalidate(VGACommonState *s1)
2182 {
2183     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2184     int size;
2185 
2186     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2187         size = 0;
2188     } else {
2189         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2190             size = 64;
2191         else
2192             size = 32;
2193     }
2194     /* invalidate last cursor and new cursor if any change */
2195     if (s->last_hw_cursor_size != size ||
2196         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2197         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2198 
2199         invalidate_cursor1(s);
2200 
2201         s->last_hw_cursor_size = size;
2202         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2203         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2204         /* compute the real cursor min and max y */
2205         cirrus_cursor_compute_yrange(s);
2206         invalidate_cursor1(s);
2207     }
2208 }
2209 
2210 static void vga_draw_cursor_line(uint8_t *d1,
2211                                  const uint8_t *src1,
2212                                  int poffset, int w,
2213                                  unsigned int color0,
2214                                  unsigned int color1,
2215                                  unsigned int color_xor)
2216 {
2217     const uint8_t *plane0, *plane1;
2218     int x, b0, b1;
2219     uint8_t *d;
2220 
2221     d = d1;
2222     plane0 = src1;
2223     plane1 = src1 + poffset;
2224     for (x = 0; x < w; x++) {
2225         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2226         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2227         switch (b0 | (b1 << 1)) {
2228         case 0:
2229             break;
2230         case 1:
2231             ((uint32_t *)d)[0] ^= color_xor;
2232             break;
2233         case 2:
2234             ((uint32_t *)d)[0] = color0;
2235             break;
2236         case 3:
2237             ((uint32_t *)d)[0] = color1;
2238             break;
2239         }
2240         d += 4;
2241     }
2242 }
2243 
2244 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2245 {
2246     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2247     int w, h, x1, x2, poffset;
2248     unsigned int color0, color1;
2249     const uint8_t *palette, *src;
2250     uint32_t content;
2251 
2252     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2253         return;
2254     /* fast test to see if the cursor intersects with the scan line */
2255     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2256         h = 64;
2257     } else {
2258         h = 32;
2259     }
2260     if (scr_y < s->vga.hw_cursor_y ||
2261         scr_y >= (s->vga.hw_cursor_y + h)) {
2262         return;
2263     }
2264 
2265     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2266     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2267         src += (s->vga.sr[0x13] & 0x3c) * 256;
2268         src += (scr_y - s->vga.hw_cursor_y) * 16;
2269         poffset = 8;
2270         content = ((uint32_t *)src)[0] |
2271             ((uint32_t *)src)[1] |
2272             ((uint32_t *)src)[2] |
2273             ((uint32_t *)src)[3];
2274     } else {
2275         src += (s->vga.sr[0x13] & 0x3f) * 256;
2276         src += (scr_y - s->vga.hw_cursor_y) * 4;
2277 
2278 
2279         poffset = 128;
2280         content = ((uint32_t *)src)[0] |
2281             ((uint32_t *)(src + 128))[0];
2282     }
2283     /* if nothing to draw, no need to continue */
2284     if (!content)
2285         return;
2286     w = h;
2287 
2288     x1 = s->vga.hw_cursor_x;
2289     if (x1 >= s->vga.last_scr_width)
2290         return;
2291     x2 = s->vga.hw_cursor_x + w;
2292     if (x2 > s->vga.last_scr_width)
2293         x2 = s->vga.last_scr_width;
2294     w = x2 - x1;
2295     palette = s->cirrus_hidden_palette;
2296     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2297                             c6_to_8(palette[0x0 * 3 + 1]),
2298                             c6_to_8(palette[0x0 * 3 + 2]));
2299     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2300                             c6_to_8(palette[0xf * 3 + 1]),
2301                             c6_to_8(palette[0xf * 3 + 2]));
2302     d1 += x1 * 4;
2303     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2304 }
2305 
2306 /***************************************
2307  *
2308  *  LFB memory access
2309  *
2310  ***************************************/
2311 
2312 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2313                                    unsigned size)
2314 {
2315     CirrusVGAState *s = opaque;
2316     uint32_t ret;
2317 
2318     addr &= s->cirrus_addr_mask;
2319 
2320     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2321         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2322 	/* memory-mapped I/O */
2323 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2324     } else if (0) {
2325 	/* XXX handle bitblt */
2326 	ret = 0xff;
2327     } else {
2328 	/* video memory */
2329 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2330 	    addr <<= 4;
2331 	} else if (s->vga.gr[0x0B] & 0x02) {
2332 	    addr <<= 3;
2333 	}
2334 	addr &= s->cirrus_addr_mask;
2335 	ret = *(s->vga.vram_ptr + addr);
2336     }
2337 
2338     return ret;
2339 }
2340 
2341 static void cirrus_linear_write(void *opaque, hwaddr addr,
2342                                 uint64_t val, unsigned size)
2343 {
2344     CirrusVGAState *s = opaque;
2345     unsigned mode;
2346 
2347     addr &= s->cirrus_addr_mask;
2348 
2349     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2350         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2351 	/* memory-mapped I/O */
2352 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2353     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2354 	/* bitblt */
2355 	*s->cirrus_srcptr++ = (uint8_t) val;
2356 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2357 	    cirrus_bitblt_cputovideo_next(s);
2358 	}
2359     } else {
2360 	/* video memory */
2361 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2362 	    addr <<= 4;
2363 	} else if (s->vga.gr[0x0B] & 0x02) {
2364 	    addr <<= 3;
2365 	}
2366 	addr &= s->cirrus_addr_mask;
2367 
2368 	mode = s->vga.gr[0x05] & 0x7;
2369 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2370 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2371             memory_region_set_dirty(&s->vga.vram, addr, 1);
2372 	} else {
2373 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2374 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2375 	    } else {
2376 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2377 	    }
2378 	}
2379     }
2380 }
2381 
2382 /***************************************
2383  *
2384  *  system to screen memory access
2385  *
2386  ***************************************/
2387 
2388 
2389 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2390                                           hwaddr addr,
2391                                           unsigned size)
2392 {
2393     CirrusVGAState *s = opaque;
2394     uint32_t ret;
2395 
2396     /* XXX handle bitblt */
2397     (void)s;
2398     ret = 0xff;
2399     return ret;
2400 }
2401 
2402 static void cirrus_linear_bitblt_write(void *opaque,
2403                                        hwaddr addr,
2404                                        uint64_t val,
2405                                        unsigned size)
2406 {
2407     CirrusVGAState *s = opaque;
2408 
2409     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2410 	/* bitblt */
2411 	*s->cirrus_srcptr++ = (uint8_t) val;
2412 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2413 	    cirrus_bitblt_cputovideo_next(s);
2414 	}
2415     }
2416 }
2417 
2418 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2419     .read = cirrus_linear_bitblt_read,
2420     .write = cirrus_linear_bitblt_write,
2421     .endianness = DEVICE_LITTLE_ENDIAN,
2422     .impl = {
2423         .min_access_size = 1,
2424         .max_access_size = 1,
2425     },
2426 };
2427 
2428 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2429 {
2430     MemoryRegion *mr = &s->cirrus_bank[bank];
2431     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2432         && !((s->vga.sr[0x07] & 0x01) == 0)
2433         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2434         && !(s->vga.gr[0x0B] & 0x02);
2435 
2436     memory_region_set_enabled(mr, enabled);
2437     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2438 }
2439 
2440 static void map_linear_vram(CirrusVGAState *s)
2441 {
2442     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2443         s->linear_vram = true;
2444         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2445     }
2446     map_linear_vram_bank(s, 0);
2447     map_linear_vram_bank(s, 1);
2448 }
2449 
2450 static void unmap_linear_vram(CirrusVGAState *s)
2451 {
2452     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2453         s->linear_vram = false;
2454         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2455     }
2456     memory_region_set_enabled(&s->cirrus_bank[0], false);
2457     memory_region_set_enabled(&s->cirrus_bank[1], false);
2458 }
2459 
2460 /* Compute the memory access functions */
2461 static void cirrus_update_memory_access(CirrusVGAState *s)
2462 {
2463     unsigned mode;
2464 
2465     memory_region_transaction_begin();
2466     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2467         goto generic_io;
2468     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2469         goto generic_io;
2470     } else {
2471 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2472             goto generic_io;
2473 	} else if (s->vga.gr[0x0B] & 0x02) {
2474             goto generic_io;
2475         }
2476 
2477 	mode = s->vga.gr[0x05] & 0x7;
2478 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2479             map_linear_vram(s);
2480         } else {
2481         generic_io:
2482             unmap_linear_vram(s);
2483         }
2484     }
2485     memory_region_transaction_commit();
2486 }
2487 
2488 
2489 /* I/O ports */
2490 
2491 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2492                                        unsigned size)
2493 {
2494     CirrusVGAState *c = opaque;
2495     VGACommonState *s = &c->vga;
2496     int val, index;
2497 
2498     addr += 0x3b0;
2499 
2500     if (vga_ioport_invalid(s, addr)) {
2501 	val = 0xff;
2502     } else {
2503 	switch (addr) {
2504 	case 0x3c0:
2505 	    if (s->ar_flip_flop == 0) {
2506 		val = s->ar_index;
2507 	    } else {
2508 		val = 0;
2509 	    }
2510 	    break;
2511 	case 0x3c1:
2512 	    index = s->ar_index & 0x1f;
2513 	    if (index < 21)
2514 		val = s->ar[index];
2515 	    else
2516 		val = 0;
2517 	    break;
2518 	case 0x3c2:
2519 	    val = s->st00;
2520 	    break;
2521 	case 0x3c4:
2522 	    val = s->sr_index;
2523 	    break;
2524 	case 0x3c5:
2525 	    val = cirrus_vga_read_sr(c);
2526             break;
2527 #ifdef DEBUG_VGA_REG
2528 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2529 #endif
2530 	    break;
2531 	case 0x3c6:
2532 	    val = cirrus_read_hidden_dac(c);
2533 	    break;
2534 	case 0x3c7:
2535 	    val = s->dac_state;
2536 	    break;
2537 	case 0x3c8:
2538 	    val = s->dac_write_index;
2539 	    c->cirrus_hidden_dac_lockindex = 0;
2540 	    break;
2541         case 0x3c9:
2542             val = cirrus_vga_read_palette(c);
2543             break;
2544 	case 0x3ca:
2545 	    val = s->fcr;
2546 	    break;
2547 	case 0x3cc:
2548 	    val = s->msr;
2549 	    break;
2550 	case 0x3ce:
2551 	    val = s->gr_index;
2552 	    break;
2553 	case 0x3cf:
2554 	    val = cirrus_vga_read_gr(c, s->gr_index);
2555 #ifdef DEBUG_VGA_REG
2556 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2557 #endif
2558 	    break;
2559 	case 0x3b4:
2560 	case 0x3d4:
2561 	    val = s->cr_index;
2562 	    break;
2563 	case 0x3b5:
2564 	case 0x3d5:
2565             val = cirrus_vga_read_cr(c, s->cr_index);
2566 #ifdef DEBUG_VGA_REG
2567 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2568 #endif
2569 	    break;
2570 	case 0x3ba:
2571 	case 0x3da:
2572 	    /* just toggle to fool polling */
2573 	    val = s->st01 = s->retrace(s);
2574 	    s->ar_flip_flop = 0;
2575 	    break;
2576 	default:
2577 	    val = 0x00;
2578 	    break;
2579 	}
2580     }
2581 #if defined(DEBUG_VGA)
2582     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
2583 #endif
2584     return val;
2585 }
2586 
2587 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2588                                     unsigned size)
2589 {
2590     CirrusVGAState *c = opaque;
2591     VGACommonState *s = &c->vga;
2592     int index;
2593 
2594     addr += 0x3b0;
2595 
2596     /* check port range access depending on color/monochrome mode */
2597     if (vga_ioport_invalid(s, addr)) {
2598 	return;
2599     }
2600 #ifdef DEBUG_VGA
2601     printf("VGA: write addr=0x%04x data=0x%02x\n", addr, val);
2602 #endif
2603 
2604     switch (addr) {
2605     case 0x3c0:
2606 	if (s->ar_flip_flop == 0) {
2607 	    val &= 0x3f;
2608 	    s->ar_index = val;
2609 	} else {
2610 	    index = s->ar_index & 0x1f;
2611 	    switch (index) {
2612 	    case 0x00 ... 0x0f:
2613 		s->ar[index] = val & 0x3f;
2614 		break;
2615 	    case 0x10:
2616 		s->ar[index] = val & ~0x10;
2617 		break;
2618 	    case 0x11:
2619 		s->ar[index] = val;
2620 		break;
2621 	    case 0x12:
2622 		s->ar[index] = val & ~0xc0;
2623 		break;
2624 	    case 0x13:
2625 		s->ar[index] = val & ~0xf0;
2626 		break;
2627 	    case 0x14:
2628 		s->ar[index] = val & ~0xf0;
2629 		break;
2630 	    default:
2631 		break;
2632 	    }
2633 	}
2634 	s->ar_flip_flop ^= 1;
2635 	break;
2636     case 0x3c2:
2637 	s->msr = val & ~0x10;
2638 	s->update_retrace_info(s);
2639 	break;
2640     case 0x3c4:
2641 	s->sr_index = val;
2642 	break;
2643     case 0x3c5:
2644 #ifdef DEBUG_VGA_REG
2645 	printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2646 #endif
2647 	cirrus_vga_write_sr(c, val);
2648         break;
2649     case 0x3c6:
2650 	cirrus_write_hidden_dac(c, val);
2651 	break;
2652     case 0x3c7:
2653 	s->dac_read_index = val;
2654 	s->dac_sub_index = 0;
2655 	s->dac_state = 3;
2656 	break;
2657     case 0x3c8:
2658 	s->dac_write_index = val;
2659 	s->dac_sub_index = 0;
2660 	s->dac_state = 0;
2661 	break;
2662     case 0x3c9:
2663         cirrus_vga_write_palette(c, val);
2664         break;
2665     case 0x3ce:
2666 	s->gr_index = val;
2667 	break;
2668     case 0x3cf:
2669 #ifdef DEBUG_VGA_REG
2670 	printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2671 #endif
2672 	cirrus_vga_write_gr(c, s->gr_index, val);
2673 	break;
2674     case 0x3b4:
2675     case 0x3d4:
2676 	s->cr_index = val;
2677 	break;
2678     case 0x3b5:
2679     case 0x3d5:
2680 #ifdef DEBUG_VGA_REG
2681 	printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2682 #endif
2683 	cirrus_vga_write_cr(c, val);
2684 	break;
2685     case 0x3ba:
2686     case 0x3da:
2687 	s->fcr = val & 0x10;
2688 	break;
2689     }
2690 }
2691 
2692 /***************************************
2693  *
2694  *  memory-mapped I/O access
2695  *
2696  ***************************************/
2697 
2698 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2699                                  unsigned size)
2700 {
2701     CirrusVGAState *s = opaque;
2702 
2703     if (addr >= 0x100) {
2704         return cirrus_mmio_blt_read(s, addr - 0x100);
2705     } else {
2706         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2707     }
2708 }
2709 
2710 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2711                               uint64_t val, unsigned size)
2712 {
2713     CirrusVGAState *s = opaque;
2714 
2715     if (addr >= 0x100) {
2716 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2717     } else {
2718         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2719     }
2720 }
2721 
2722 static const MemoryRegionOps cirrus_mmio_io_ops = {
2723     .read = cirrus_mmio_read,
2724     .write = cirrus_mmio_write,
2725     .endianness = DEVICE_LITTLE_ENDIAN,
2726     .impl = {
2727         .min_access_size = 1,
2728         .max_access_size = 1,
2729     },
2730 };
2731 
2732 /* load/save state */
2733 
2734 static int cirrus_post_load(void *opaque, int version_id)
2735 {
2736     CirrusVGAState *s = opaque;
2737 
2738     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2739     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2740 
2741     cirrus_update_memory_access(s);
2742     /* force refresh */
2743     s->vga.graphic_mode = -1;
2744     cirrus_update_bank_ptr(s, 0);
2745     cirrus_update_bank_ptr(s, 1);
2746     return 0;
2747 }
2748 
2749 static const VMStateDescription vmstate_cirrus_vga = {
2750     .name = "cirrus_vga",
2751     .version_id = 2,
2752     .minimum_version_id = 1,
2753     .post_load = cirrus_post_load,
2754     .fields = (VMStateField[]) {
2755         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2756         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2757         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2758         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2759         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2760         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2761         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2762         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2763         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2764         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2765         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2766         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2767         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2768         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2769         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2770         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2771         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2772         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2773         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2774         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2775         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2776         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2777         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2778         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2779         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2780         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2781         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2782         /* XXX: we do not save the bitblt state - we assume we do not save
2783            the state when the blitter is active */
2784         VMSTATE_END_OF_LIST()
2785     }
2786 };
2787 
2788 static const VMStateDescription vmstate_pci_cirrus_vga = {
2789     .name = "cirrus_vga",
2790     .version_id = 2,
2791     .minimum_version_id = 2,
2792     .fields = (VMStateField[]) {
2793         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2794         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2795                        vmstate_cirrus_vga, CirrusVGAState),
2796         VMSTATE_END_OF_LIST()
2797     }
2798 };
2799 
2800 /***************************************
2801  *
2802  *  initialize
2803  *
2804  ***************************************/
2805 
2806 static void cirrus_reset(void *opaque)
2807 {
2808     CirrusVGAState *s = opaque;
2809 
2810     vga_common_reset(&s->vga);
2811     unmap_linear_vram(s);
2812     s->vga.sr[0x06] = 0x0f;
2813     if (s->device_id == CIRRUS_ID_CLGD5446) {
2814         /* 4MB 64 bit memory config, always PCI */
2815         s->vga.sr[0x1F] = 0x2d;		// MemClock
2816         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2817         s->vga.sr[0x0f] = 0x98;
2818         s->vga.sr[0x17] = 0x20;
2819         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2820     } else {
2821         s->vga.sr[0x1F] = 0x22;		// MemClock
2822         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2823         s->vga.sr[0x17] = s->bustype;
2824         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2825     }
2826     s->vga.cr[0x27] = s->device_id;
2827 
2828     s->cirrus_hidden_dac_lockindex = 5;
2829     s->cirrus_hidden_dac_data = 0;
2830 }
2831 
2832 static const MemoryRegionOps cirrus_linear_io_ops = {
2833     .read = cirrus_linear_read,
2834     .write = cirrus_linear_write,
2835     .endianness = DEVICE_LITTLE_ENDIAN,
2836     .impl = {
2837         .min_access_size = 1,
2838         .max_access_size = 1,
2839     },
2840 };
2841 
2842 static const MemoryRegionOps cirrus_vga_io_ops = {
2843     .read = cirrus_vga_ioport_read,
2844     .write = cirrus_vga_ioport_write,
2845     .endianness = DEVICE_LITTLE_ENDIAN,
2846     .impl = {
2847         .min_access_size = 1,
2848         .max_access_size = 1,
2849     },
2850 };
2851 
2852 static void cirrus_init_common(CirrusVGAState *s, Object *owner,
2853                                int device_id, int is_pci,
2854                                MemoryRegion *system_memory,
2855                                MemoryRegion *system_io)
2856 {
2857     int i;
2858     static int inited;
2859 
2860     if (!inited) {
2861         inited = 1;
2862         for(i = 0;i < 256; i++)
2863             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2864         rop_to_index[CIRRUS_ROP_0] = 0;
2865         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2866         rop_to_index[CIRRUS_ROP_NOP] = 2;
2867         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2868         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2869         rop_to_index[CIRRUS_ROP_SRC] = 5;
2870         rop_to_index[CIRRUS_ROP_1] = 6;
2871         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2872         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2873         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2874         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2875         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2876         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2877         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2878         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2879         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2880         s->device_id = device_id;
2881         if (is_pci)
2882             s->bustype = CIRRUS_BUSTYPE_PCI;
2883         else
2884             s->bustype = CIRRUS_BUSTYPE_ISA;
2885     }
2886 
2887     /* Register ioport 0x3b0 - 0x3df */
2888     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2889                           "cirrus-io", 0x30);
2890     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2891     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2892 
2893     memory_region_init(&s->low_mem_container, owner,
2894                        "cirrus-lowmem-container",
2895                        0x20000);
2896 
2897     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2898                           "cirrus-low-memory", 0x20000);
2899     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2900     for (i = 0; i < 2; ++i) {
2901         static const char *names[] = { "vga.bank0", "vga.bank1" };
2902         MemoryRegion *bank = &s->cirrus_bank[i];
2903         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2904                                  0, 0x8000);
2905         memory_region_set_enabled(bank, false);
2906         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2907                                             bank, 1);
2908     }
2909     memory_region_add_subregion_overlap(system_memory,
2910                                         0x000a0000,
2911                                         &s->low_mem_container,
2912                                         1);
2913     memory_region_set_coalescing(&s->low_mem);
2914 
2915     /* I/O handler for LFB */
2916     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2917                           "cirrus-linear-io", s->vga.vram_size_mb
2918                                               * 1024 * 1024);
2919     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2920 
2921     /* I/O handler for LFB */
2922     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2923                           &cirrus_linear_bitblt_io_ops,
2924                           s,
2925                           "cirrus-bitblt-mmio",
2926                           0x400000);
2927     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2928 
2929     /* I/O handler for memory-mapped I/O */
2930     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2931                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2932     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2933 
2934     s->real_vram_size =
2935         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
2936 
2937     /* XXX: s->vga.vram_size must be a power of two */
2938     s->cirrus_addr_mask = s->real_vram_size - 1;
2939     s->linear_mmio_mask = s->real_vram_size - 256;
2940 
2941     s->vga.get_bpp = cirrus_get_bpp;
2942     s->vga.get_offsets = cirrus_get_offsets;
2943     s->vga.get_resolution = cirrus_get_resolution;
2944     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2945     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2946 
2947     qemu_register_reset(cirrus_reset, s);
2948 }
2949 
2950 /***************************************
2951  *
2952  *  ISA bus support
2953  *
2954  ***************************************/
2955 
2956 static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
2957 {
2958     ISADevice *isadev = ISA_DEVICE(dev);
2959     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
2960     VGACommonState *s = &d->cirrus_vga.vga;
2961 
2962     /* follow real hardware, cirrus card emulated has 4 MB video memory.
2963        Also accept 8 MB/16 MB for backward compatibility. */
2964     if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&
2965         s->vram_size_mb != 16) {
2966         error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2967                    s->vram_size_mb);
2968         return;
2969     }
2970     vga_common_init(s, OBJECT(dev), true);
2971     cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
2972                        isa_address_space(isadev),
2973                        isa_address_space_io(isadev));
2974     s->con = graphic_console_init(dev, 0, s->hw_ops, s);
2975     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
2976     /* XXX ISA-LFB support */
2977     /* FIXME not qdev yet */
2978 }
2979 
2980 static Property isa_cirrus_vga_properties[] = {
2981     DEFINE_PROP_UINT32("vgamem_mb", struct ISACirrusVGAState,
2982                        cirrus_vga.vga.vram_size_mb, 8),
2983     DEFINE_PROP_END_OF_LIST(),
2984 };
2985 
2986 static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
2987 {
2988     DeviceClass *dc = DEVICE_CLASS(klass);
2989 
2990     dc->vmsd  = &vmstate_cirrus_vga;
2991     dc->realize = isa_cirrus_vga_realizefn;
2992     dc->props = isa_cirrus_vga_properties;
2993     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2994 }
2995 
2996 static const TypeInfo isa_cirrus_vga_info = {
2997     .name          = TYPE_ISA_CIRRUS_VGA,
2998     .parent        = TYPE_ISA_DEVICE,
2999     .instance_size = sizeof(ISACirrusVGAState),
3000     .class_init = isa_cirrus_vga_class_init,
3001 };
3002 
3003 /***************************************
3004  *
3005  *  PCI bus support
3006  *
3007  ***************************************/
3008 
3009 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
3010 {
3011      PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);
3012      CirrusVGAState *s = &d->cirrus_vga;
3013      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
3014      int16_t device_id = pc->device_id;
3015 
3016      /* follow real hardware, cirrus card emulated has 4 MB video memory.
3017        Also accept 8 MB/16 MB for backward compatibility. */
3018      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
3019          s->vga.vram_size_mb != 16) {
3020          error_setg(errp, "Invalid cirrus_vga ram size '%u'",
3021                     s->vga.vram_size_mb);
3022          return;
3023      }
3024      /* setup VGA */
3025      vga_common_init(&s->vga, OBJECT(dev), true);
3026      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
3027                         pci_address_space_io(dev));
3028      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
3029 
3030      /* setup PCI */
3031 
3032     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
3033 
3034     /* XXX: add byte swapping apertures */
3035     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
3036     memory_region_add_subregion(&s->pci_bar, 0x1000000,
3037                                 &s->cirrus_linear_bitblt_io);
3038 
3039      /* setup memory space */
3040      /* memory #0 LFB */
3041      /* memory #1 memory-mapped I/O */
3042      /* XXX: s->vga.vram_size must be a power of two */
3043      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
3044      if (device_id == CIRRUS_ID_CLGD5446) {
3045          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
3046      }
3047 }
3048 
3049 static Property pci_vga_cirrus_properties[] = {
3050     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
3051                        cirrus_vga.vga.vram_size_mb, 8),
3052     DEFINE_PROP_END_OF_LIST(),
3053 };
3054 
3055 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3056 {
3057     DeviceClass *dc = DEVICE_CLASS(klass);
3058     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3059 
3060     k->realize = pci_cirrus_vga_realize;
3061     k->romfile = VGABIOS_CIRRUS_FILENAME;
3062     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3063     k->device_id = CIRRUS_ID_CLGD5446;
3064     k->class_id = PCI_CLASS_DISPLAY_VGA;
3065     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3066     dc->desc = "Cirrus CLGD 54xx VGA";
3067     dc->vmsd = &vmstate_pci_cirrus_vga;
3068     dc->props = pci_vga_cirrus_properties;
3069     dc->hotpluggable = false;
3070 }
3071 
3072 static const TypeInfo cirrus_vga_info = {
3073     .name          = "cirrus-vga",
3074     .parent        = TYPE_PCI_DEVICE,
3075     .instance_size = sizeof(PCICirrusVGAState),
3076     .class_init    = cirrus_vga_class_init,
3077 };
3078 
3079 static void cirrus_vga_register_types(void)
3080 {
3081     type_register_static(&isa_cirrus_vga_info);
3082     type_register_static(&cirrus_vga_info);
3083 }
3084 
3085 type_init(cirrus_vga_register_types)
3086