xref: /openbmc/qemu/hw/display/cirrus_vga.c (revision db725815)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b:
27  *
28  *  http://web.archive.org/web/20021019054927/http://home.worldonline.dk/finth/
29  *
30  * VGADOC4b.ZIP content available at:
31  *
32  *  https://pdos.csail.mit.edu/6.828/2005/readings/hardware/vgadoc
33  */
34 
35 #include "qemu/osdep.h"
36 #include "qemu/module.h"
37 #include "qemu/units.h"
38 #include "sysemu/reset.h"
39 #include "qapi/error.h"
40 #include "trace.h"
41 #include "hw/pci/pci.h"
42 #include "migration/vmstate.h"
43 #include "ui/pixel_ops.h"
44 #include "cirrus_vga_internal.h"
45 
46 /*
47  * TODO:
48  *    - destination write mask support not complete (bits 5..7)
49  *    - optimize linear mappings
50  *    - optimize bitblt functions
51  */
52 
53 //#define DEBUG_CIRRUS
54 //#define DEBUG_BITBLT
55 
56 /***************************************
57  *
58  *  definitions
59  *
60  ***************************************/
61 
62 // sequencer 0x07
63 #define CIRRUS_SR7_BPP_VGA            0x00
64 #define CIRRUS_SR7_BPP_SVGA           0x01
65 #define CIRRUS_SR7_BPP_MASK           0x0e
66 #define CIRRUS_SR7_BPP_8              0x00
67 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
68 #define CIRRUS_SR7_BPP_24             0x04
69 #define CIRRUS_SR7_BPP_16             0x06
70 #define CIRRUS_SR7_BPP_32             0x08
71 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
72 
73 // sequencer 0x0f
74 #define CIRRUS_MEMSIZE_512k        0x08
75 #define CIRRUS_MEMSIZE_1M          0x10
76 #define CIRRUS_MEMSIZE_2M          0x18
77 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
78 
79 // sequencer 0x12
80 #define CIRRUS_CURSOR_SHOW         0x01
81 #define CIRRUS_CURSOR_HIDDENPEL    0x02
82 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
83 
84 // sequencer 0x17
85 #define CIRRUS_BUSTYPE_VLBFAST   0x10
86 #define CIRRUS_BUSTYPE_PCI       0x20
87 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
88 #define CIRRUS_BUSTYPE_ISA       0x38
89 #define CIRRUS_MMIO_ENABLE       0x04
90 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
91 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
92 
93 // control 0x0b
94 #define CIRRUS_BANKING_DUAL             0x01
95 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
96 
97 // control 0x30
98 #define CIRRUS_BLTMODE_BACKWARDS        0x01
99 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
100 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
101 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
102 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
103 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
104 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
105 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
106 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
107 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
108 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
109 
110 // control 0x31
111 #define CIRRUS_BLT_BUSY                 0x01
112 #define CIRRUS_BLT_START                0x02
113 #define CIRRUS_BLT_RESET                0x04
114 #define CIRRUS_BLT_FIFOUSED             0x10
115 #define CIRRUS_BLT_AUTOSTART            0x80
116 
117 // control 0x32
118 #define CIRRUS_ROP_0                    0x00
119 #define CIRRUS_ROP_SRC_AND_DST          0x05
120 #define CIRRUS_ROP_NOP                  0x06
121 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
122 #define CIRRUS_ROP_NOTDST               0x0b
123 #define CIRRUS_ROP_SRC                  0x0d
124 #define CIRRUS_ROP_1                    0x0e
125 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
126 #define CIRRUS_ROP_SRC_XOR_DST          0x59
127 #define CIRRUS_ROP_SRC_OR_DST           0x6d
128 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
129 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
130 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
131 #define CIRRUS_ROP_NOTSRC               0xd0
132 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
133 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
134 
135 #define CIRRUS_ROP_NOP_INDEX 2
136 #define CIRRUS_ROP_SRC_INDEX 5
137 
138 // control 0x33
139 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
140 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
141 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
142 
143 // memory-mapped IO
144 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
145 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
146 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
147 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
148 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
149 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
150 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
151 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
152 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
153 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
154 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
155 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
156 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
157 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
158 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
159 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
160 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
161 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
162 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
166 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
167 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
168 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
169 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
170 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
171 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
172 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
173 
174 #define CIRRUS_PNPMMIO_SIZE         0x1000
175 
176 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
177                               uint32_t dstaddr, int dst_pitch,
178                               int width, int height);
179 
180 typedef struct PCICirrusVGAState {
181     PCIDevice dev;
182     CirrusVGAState cirrus_vga;
183 } PCICirrusVGAState;
184 
185 #define TYPE_PCI_CIRRUS_VGA "cirrus-vga"
186 #define PCI_CIRRUS_VGA(obj) \
187     OBJECT_CHECK(PCICirrusVGAState, (obj), TYPE_PCI_CIRRUS_VGA)
188 
189 static uint8_t rop_to_index[256];
190 
191 /***************************************
192  *
193  *  prototypes.
194  *
195  ***************************************/
196 
197 
198 static void cirrus_bitblt_reset(CirrusVGAState *s);
199 static void cirrus_update_memory_access(CirrusVGAState *s);
200 
201 /***************************************
202  *
203  *  raster operations
204  *
205  ***************************************/
206 
207 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
208                                   int32_t pitch, int32_t addr)
209 {
210     if (!pitch) {
211         return true;
212     }
213     if (pitch < 0) {
214         int64_t min = addr
215             + ((int64_t)s->cirrus_blt_height - 1) * pitch
216             - s->cirrus_blt_width;
217         if (min < -1 || addr >= s->vga.vram_size) {
218             return true;
219         }
220     } else {
221         int64_t max = addr
222             + ((int64_t)s->cirrus_blt_height-1) * pitch
223             + s->cirrus_blt_width;
224         if (max > s->vga.vram_size) {
225             return true;
226         }
227     }
228     return false;
229 }
230 
231 static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)
232 {
233     /* should be the case, see cirrus_bitblt_start */
234     assert(s->cirrus_blt_width > 0);
235     assert(s->cirrus_blt_height > 0);
236 
237     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
238         return true;
239     }
240 
241     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
242                               s->cirrus_blt_dstaddr)) {
243         return true;
244     }
245     if (dst_only) {
246         return false;
247     }
248     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
249                               s->cirrus_blt_srcaddr)) {
250         return true;
251     }
252 
253     return false;
254 }
255 
256 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
257                                   uint32_t dstaddr, uint32_t srcaddr,
258                                   int dstpitch,int srcpitch,
259                                   int bltwidth,int bltheight)
260 {
261 }
262 
263 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
264                                    uint32_t dstaddr,
265                                    int dstpitch, int bltwidth,int bltheight)
266 {
267 }
268 
269 static inline uint8_t cirrus_src(CirrusVGAState *s, uint32_t srcaddr)
270 {
271     if (s->cirrus_srccounter) {
272         /* cputovideo */
273         return s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1)];
274     } else {
275         /* videotovideo */
276         return s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask];
277     }
278 }
279 
280 static inline uint16_t cirrus_src16(CirrusVGAState *s, uint32_t srcaddr)
281 {
282     uint16_t *src;
283 
284     if (s->cirrus_srccounter) {
285         /* cputovideo */
286         src = (void *)&s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1) & ~1];
287     } else {
288         /* videotovideo */
289         src = (void *)&s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask & ~1];
290     }
291     return *src;
292 }
293 
294 static inline uint32_t cirrus_src32(CirrusVGAState *s, uint32_t srcaddr)
295 {
296     uint32_t *src;
297 
298     if (s->cirrus_srccounter) {
299         /* cputovideo */
300         src = (void *)&s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1) & ~3];
301     } else {
302         /* videotovideo */
303         src = (void *)&s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask & ~3];
304     }
305     return *src;
306 }
307 
308 #define ROP_NAME 0
309 #define ROP_FN(d, s) 0
310 #include "cirrus_vga_rop.h"
311 
312 #define ROP_NAME src_and_dst
313 #define ROP_FN(d, s) (s) & (d)
314 #include "cirrus_vga_rop.h"
315 
316 #define ROP_NAME src_and_notdst
317 #define ROP_FN(d, s) (s) & (~(d))
318 #include "cirrus_vga_rop.h"
319 
320 #define ROP_NAME notdst
321 #define ROP_FN(d, s) ~(d)
322 #include "cirrus_vga_rop.h"
323 
324 #define ROP_NAME src
325 #define ROP_FN(d, s) s
326 #include "cirrus_vga_rop.h"
327 
328 #define ROP_NAME 1
329 #define ROP_FN(d, s) ~0
330 #include "cirrus_vga_rop.h"
331 
332 #define ROP_NAME notsrc_and_dst
333 #define ROP_FN(d, s) (~(s)) & (d)
334 #include "cirrus_vga_rop.h"
335 
336 #define ROP_NAME src_xor_dst
337 #define ROP_FN(d, s) (s) ^ (d)
338 #include "cirrus_vga_rop.h"
339 
340 #define ROP_NAME src_or_dst
341 #define ROP_FN(d, s) (s) | (d)
342 #include "cirrus_vga_rop.h"
343 
344 #define ROP_NAME notsrc_or_notdst
345 #define ROP_FN(d, s) (~(s)) | (~(d))
346 #include "cirrus_vga_rop.h"
347 
348 #define ROP_NAME src_notxor_dst
349 #define ROP_FN(d, s) ~((s) ^ (d))
350 #include "cirrus_vga_rop.h"
351 
352 #define ROP_NAME src_or_notdst
353 #define ROP_FN(d, s) (s) | (~(d))
354 #include "cirrus_vga_rop.h"
355 
356 #define ROP_NAME notsrc
357 #define ROP_FN(d, s) (~(s))
358 #include "cirrus_vga_rop.h"
359 
360 #define ROP_NAME notsrc_or_dst
361 #define ROP_FN(d, s) (~(s)) | (d)
362 #include "cirrus_vga_rop.h"
363 
364 #define ROP_NAME notsrc_and_notdst
365 #define ROP_FN(d, s) (~(s)) & (~(d))
366 #include "cirrus_vga_rop.h"
367 
368 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
369     cirrus_bitblt_rop_fwd_0,
370     cirrus_bitblt_rop_fwd_src_and_dst,
371     cirrus_bitblt_rop_nop,
372     cirrus_bitblt_rop_fwd_src_and_notdst,
373     cirrus_bitblt_rop_fwd_notdst,
374     cirrus_bitblt_rop_fwd_src,
375     cirrus_bitblt_rop_fwd_1,
376     cirrus_bitblt_rop_fwd_notsrc_and_dst,
377     cirrus_bitblt_rop_fwd_src_xor_dst,
378     cirrus_bitblt_rop_fwd_src_or_dst,
379     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
380     cirrus_bitblt_rop_fwd_src_notxor_dst,
381     cirrus_bitblt_rop_fwd_src_or_notdst,
382     cirrus_bitblt_rop_fwd_notsrc,
383     cirrus_bitblt_rop_fwd_notsrc_or_dst,
384     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
385 };
386 
387 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
388     cirrus_bitblt_rop_bkwd_0,
389     cirrus_bitblt_rop_bkwd_src_and_dst,
390     cirrus_bitblt_rop_nop,
391     cirrus_bitblt_rop_bkwd_src_and_notdst,
392     cirrus_bitblt_rop_bkwd_notdst,
393     cirrus_bitblt_rop_bkwd_src,
394     cirrus_bitblt_rop_bkwd_1,
395     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
396     cirrus_bitblt_rop_bkwd_src_xor_dst,
397     cirrus_bitblt_rop_bkwd_src_or_dst,
398     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
399     cirrus_bitblt_rop_bkwd_src_notxor_dst,
400     cirrus_bitblt_rop_bkwd_src_or_notdst,
401     cirrus_bitblt_rop_bkwd_notsrc,
402     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
403     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
404 };
405 
406 #define TRANSP_ROP(name) {\
407     name ## _8,\
408     name ## _16,\
409         }
410 #define TRANSP_NOP(func) {\
411     func,\
412     func,\
413         }
414 
415 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
416     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
417     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
418     TRANSP_NOP(cirrus_bitblt_rop_nop),
419     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
420     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
421     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
422     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
423     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
424     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
425     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
426     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
427     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
428     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
429     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
430     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
431     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
432 };
433 
434 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
435     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
436     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
437     TRANSP_NOP(cirrus_bitblt_rop_nop),
438     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
439     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
440     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
441     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
442     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
443     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
444     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
445     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
446     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
447     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
448     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
449     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
450     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
451 };
452 
453 #define ROP2(name) {\
454     name ## _8,\
455     name ## _16,\
456     name ## _24,\
457     name ## _32,\
458         }
459 
460 #define ROP_NOP2(func) {\
461     func,\
462     func,\
463     func,\
464     func,\
465         }
466 
467 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
468     ROP2(cirrus_patternfill_0),
469     ROP2(cirrus_patternfill_src_and_dst),
470     ROP_NOP2(cirrus_bitblt_rop_nop),
471     ROP2(cirrus_patternfill_src_and_notdst),
472     ROP2(cirrus_patternfill_notdst),
473     ROP2(cirrus_patternfill_src),
474     ROP2(cirrus_patternfill_1),
475     ROP2(cirrus_patternfill_notsrc_and_dst),
476     ROP2(cirrus_patternfill_src_xor_dst),
477     ROP2(cirrus_patternfill_src_or_dst),
478     ROP2(cirrus_patternfill_notsrc_or_notdst),
479     ROP2(cirrus_patternfill_src_notxor_dst),
480     ROP2(cirrus_patternfill_src_or_notdst),
481     ROP2(cirrus_patternfill_notsrc),
482     ROP2(cirrus_patternfill_notsrc_or_dst),
483     ROP2(cirrus_patternfill_notsrc_and_notdst),
484 };
485 
486 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
487     ROP2(cirrus_colorexpand_transp_0),
488     ROP2(cirrus_colorexpand_transp_src_and_dst),
489     ROP_NOP2(cirrus_bitblt_rop_nop),
490     ROP2(cirrus_colorexpand_transp_src_and_notdst),
491     ROP2(cirrus_colorexpand_transp_notdst),
492     ROP2(cirrus_colorexpand_transp_src),
493     ROP2(cirrus_colorexpand_transp_1),
494     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
495     ROP2(cirrus_colorexpand_transp_src_xor_dst),
496     ROP2(cirrus_colorexpand_transp_src_or_dst),
497     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
498     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
499     ROP2(cirrus_colorexpand_transp_src_or_notdst),
500     ROP2(cirrus_colorexpand_transp_notsrc),
501     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
502     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
503 };
504 
505 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
506     ROP2(cirrus_colorexpand_0),
507     ROP2(cirrus_colorexpand_src_and_dst),
508     ROP_NOP2(cirrus_bitblt_rop_nop),
509     ROP2(cirrus_colorexpand_src_and_notdst),
510     ROP2(cirrus_colorexpand_notdst),
511     ROP2(cirrus_colorexpand_src),
512     ROP2(cirrus_colorexpand_1),
513     ROP2(cirrus_colorexpand_notsrc_and_dst),
514     ROP2(cirrus_colorexpand_src_xor_dst),
515     ROP2(cirrus_colorexpand_src_or_dst),
516     ROP2(cirrus_colorexpand_notsrc_or_notdst),
517     ROP2(cirrus_colorexpand_src_notxor_dst),
518     ROP2(cirrus_colorexpand_src_or_notdst),
519     ROP2(cirrus_colorexpand_notsrc),
520     ROP2(cirrus_colorexpand_notsrc_or_dst),
521     ROP2(cirrus_colorexpand_notsrc_and_notdst),
522 };
523 
524 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
525     ROP2(cirrus_colorexpand_pattern_transp_0),
526     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
527     ROP_NOP2(cirrus_bitblt_rop_nop),
528     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
529     ROP2(cirrus_colorexpand_pattern_transp_notdst),
530     ROP2(cirrus_colorexpand_pattern_transp_src),
531     ROP2(cirrus_colorexpand_pattern_transp_1),
532     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
533     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
534     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
535     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
536     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
537     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
538     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
539     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
540     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
541 };
542 
543 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
544     ROP2(cirrus_colorexpand_pattern_0),
545     ROP2(cirrus_colorexpand_pattern_src_and_dst),
546     ROP_NOP2(cirrus_bitblt_rop_nop),
547     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
548     ROP2(cirrus_colorexpand_pattern_notdst),
549     ROP2(cirrus_colorexpand_pattern_src),
550     ROP2(cirrus_colorexpand_pattern_1),
551     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
552     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
553     ROP2(cirrus_colorexpand_pattern_src_or_dst),
554     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
555     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
556     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
557     ROP2(cirrus_colorexpand_pattern_notsrc),
558     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
559     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
560 };
561 
562 static const cirrus_fill_t cirrus_fill[16][4] = {
563     ROP2(cirrus_fill_0),
564     ROP2(cirrus_fill_src_and_dst),
565     ROP_NOP2(cirrus_bitblt_fill_nop),
566     ROP2(cirrus_fill_src_and_notdst),
567     ROP2(cirrus_fill_notdst),
568     ROP2(cirrus_fill_src),
569     ROP2(cirrus_fill_1),
570     ROP2(cirrus_fill_notsrc_and_dst),
571     ROP2(cirrus_fill_src_xor_dst),
572     ROP2(cirrus_fill_src_or_dst),
573     ROP2(cirrus_fill_notsrc_or_notdst),
574     ROP2(cirrus_fill_src_notxor_dst),
575     ROP2(cirrus_fill_src_or_notdst),
576     ROP2(cirrus_fill_notsrc),
577     ROP2(cirrus_fill_notsrc_or_dst),
578     ROP2(cirrus_fill_notsrc_and_notdst),
579 };
580 
581 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
582 {
583     unsigned int color;
584     switch (s->cirrus_blt_pixelwidth) {
585     case 1:
586         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
587         break;
588     case 2:
589         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
590         s->cirrus_blt_fgcol = le16_to_cpu(color);
591         break;
592     case 3:
593         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
594             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
595         break;
596     default:
597     case 4:
598         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
599             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
600         s->cirrus_blt_fgcol = le32_to_cpu(color);
601         break;
602     }
603 }
604 
605 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
606 {
607     unsigned int color;
608     switch (s->cirrus_blt_pixelwidth) {
609     case 1:
610         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
611         break;
612     case 2:
613         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
614         s->cirrus_blt_bgcol = le16_to_cpu(color);
615         break;
616     case 3:
617         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
618             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
619         break;
620     default:
621     case 4:
622         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
623             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
624         s->cirrus_blt_bgcol = le32_to_cpu(color);
625         break;
626     }
627 }
628 
629 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
630 				     int off_pitch, int bytesperline,
631 				     int lines)
632 {
633     int y;
634     int off_cur;
635     int off_cur_end;
636 
637     if (off_pitch < 0) {
638         off_begin -= bytesperline - 1;
639     }
640 
641     for (y = 0; y < lines; y++) {
642         off_cur = off_begin;
643         off_cur_end = ((off_cur + bytesperline - 1) & s->cirrus_addr_mask) + 1;
644         assert(off_cur_end >= off_cur);
645         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
646         off_begin += off_pitch;
647     }
648 }
649 
650 static int cirrus_bitblt_common_patterncopy(CirrusVGAState *s)
651 {
652     uint32_t patternsize;
653     bool videosrc = !s->cirrus_srccounter;
654 
655     if (videosrc) {
656         switch (s->vga.get_bpp(&s->vga)) {
657         case 8:
658             patternsize = 64;
659             break;
660         case 15:
661         case 16:
662             patternsize = 128;
663             break;
664         case 24:
665         case 32:
666         default:
667             patternsize = 256;
668             break;
669         }
670         s->cirrus_blt_srcaddr &= ~(patternsize - 1);
671         if (s->cirrus_blt_srcaddr + patternsize > s->vga.vram_size) {
672             return 0;
673         }
674     }
675 
676     if (blit_is_unsafe(s, true)) {
677         return 0;
678     }
679 
680     (*s->cirrus_rop) (s, s->cirrus_blt_dstaddr,
681                       videosrc ? s->cirrus_blt_srcaddr : 0,
682                       s->cirrus_blt_dstpitch, 0,
683                       s->cirrus_blt_width, s->cirrus_blt_height);
684     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
685                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
686                              s->cirrus_blt_height);
687     return 1;
688 }
689 
690 /* fill */
691 
692 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
693 {
694     cirrus_fill_t rop_func;
695 
696     if (blit_is_unsafe(s, true)) {
697         return 0;
698     }
699     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
700     rop_func(s, s->cirrus_blt_dstaddr,
701              s->cirrus_blt_dstpitch,
702              s->cirrus_blt_width, s->cirrus_blt_height);
703     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
704 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
705 			     s->cirrus_blt_height);
706     cirrus_bitblt_reset(s);
707     return 1;
708 }
709 
710 /***************************************
711  *
712  *  bitblt (video-to-video)
713  *
714  ***************************************/
715 
716 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
717 {
718     return cirrus_bitblt_common_patterncopy(s);
719 }
720 
721 static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
722 {
723     int sx = 0, sy = 0;
724     int dx = 0, dy = 0;
725     int depth = 0;
726     int notify = 0;
727 
728     /* make sure to only copy if it's a plain copy ROP */
729     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
730         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
731 
732         int width, height;
733 
734         depth = s->vga.get_bpp(&s->vga) / 8;
735         if (!depth) {
736             return 0;
737         }
738         s->vga.get_resolution(&s->vga, &width, &height);
739 
740         /* extra x, y */
741         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
742         sy = (src / ABS(s->cirrus_blt_srcpitch));
743         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
744         dy = (dst / ABS(s->cirrus_blt_dstpitch));
745 
746         /* normalize width */
747         w /= depth;
748 
749         /* if we're doing a backward copy, we have to adjust
750            our x/y to be the upper left corner (instead of the lower
751            right corner) */
752         if (s->cirrus_blt_dstpitch < 0) {
753             sx -= (s->cirrus_blt_width / depth) - 1;
754             dx -= (s->cirrus_blt_width / depth) - 1;
755             sy -= s->cirrus_blt_height - 1;
756             dy -= s->cirrus_blt_height - 1;
757         }
758 
759         /* are we in the visible portion of memory? */
760         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
761             (sx + w) <= width && (sy + h) <= height &&
762             (dx + w) <= width && (dy + h) <= height) {
763             notify = 1;
764         }
765     }
766 
767     (*s->cirrus_rop) (s, s->cirrus_blt_dstaddr,
768                       s->cirrus_blt_srcaddr,
769 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
770 		      s->cirrus_blt_width, s->cirrus_blt_height);
771 
772     if (notify) {
773         dpy_gfx_update(s->vga.con, dx, dy,
774                        s->cirrus_blt_width / depth,
775                        s->cirrus_blt_height);
776     }
777 
778     /* we don't have to notify the display that this portion has
779        changed since qemu_console_copy implies this */
780 
781     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
782 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
783 				s->cirrus_blt_height);
784 
785     return 1;
786 }
787 
788 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
789 {
790     if (blit_is_unsafe(s, false))
791         return 0;
792 
793     return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
794             s->cirrus_blt_srcaddr - s->vga.start_addr,
795             s->cirrus_blt_width, s->cirrus_blt_height);
796 }
797 
798 /***************************************
799  *
800  *  bitblt (cpu-to-video)
801  *
802  ***************************************/
803 
804 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
805 {
806     int copy_count;
807     uint8_t *end_ptr;
808 
809     if (s->cirrus_srccounter > 0) {
810         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
811             cirrus_bitblt_common_patterncopy(s);
812         the_end:
813             s->cirrus_srccounter = 0;
814             cirrus_bitblt_reset(s);
815         } else {
816             /* at least one scan line */
817             do {
818                 (*s->cirrus_rop)(s, s->cirrus_blt_dstaddr,
819                                  0, 0, 0, s->cirrus_blt_width, 1);
820                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
821                                          s->cirrus_blt_width, 1);
822                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
823                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
824                 if (s->cirrus_srccounter <= 0)
825                     goto the_end;
826                 /* more bytes than needed can be transferred because of
827                    word alignment, so we keep them for the next line */
828                 /* XXX: keep alignment to speed up transfer */
829                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
830                 copy_count = s->cirrus_srcptr_end - end_ptr;
831                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
832                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
833                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
834             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
835         }
836     }
837 }
838 
839 /***************************************
840  *
841  *  bitblt wrapper
842  *
843  ***************************************/
844 
845 static void cirrus_bitblt_reset(CirrusVGAState * s)
846 {
847     int need_update;
848 
849     s->vga.gr[0x31] &=
850 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
851     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
852         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
853     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
854     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
855     s->cirrus_srccounter = 0;
856     if (!need_update)
857         return;
858     cirrus_update_memory_access(s);
859 }
860 
861 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
862 {
863     int w;
864 
865     if (blit_is_unsafe(s, true)) {
866         return 0;
867     }
868 
869     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
870     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
871     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
872 
873     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
874 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
875 	    s->cirrus_blt_srcpitch = 8;
876 	} else {
877             /* XXX: check for 24 bpp */
878 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
879 	}
880 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
881     } else {
882 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
883             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
884             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
885                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
886             else
887                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
888 	} else {
889             /* always align input size to 32 bits */
890 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
891 	}
892         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
893     }
894 
895     /* the blit_is_unsafe call above should catch this */
896     assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
897 
898     s->cirrus_srcptr = s->cirrus_bltbuf;
899     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
900     cirrus_update_memory_access(s);
901     return 1;
902 }
903 
904 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
905 {
906     /* XXX */
907 #ifdef DEBUG_BITBLT
908     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
909 #endif
910     return 0;
911 }
912 
913 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
914 {
915     int ret;
916 
917     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
918 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
919     } else {
920 	ret = cirrus_bitblt_videotovideo_copy(s);
921     }
922     if (ret)
923 	cirrus_bitblt_reset(s);
924     return ret;
925 }
926 
927 static void cirrus_bitblt_start(CirrusVGAState * s)
928 {
929     uint8_t blt_rop;
930 
931     if (!s->enable_blitter) {
932         goto bitblt_ignore;
933     }
934 
935     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
936 
937     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
938     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
939     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
940     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
941     s->cirrus_blt_dstaddr =
942 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
943     s->cirrus_blt_srcaddr =
944 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
945     s->cirrus_blt_mode = s->vga.gr[0x30];
946     s->cirrus_blt_modeext = s->vga.gr[0x33];
947     blt_rop = s->vga.gr[0x32];
948 
949     s->cirrus_blt_dstaddr &= s->cirrus_addr_mask;
950     s->cirrus_blt_srcaddr &= s->cirrus_addr_mask;
951 
952 #ifdef DEBUG_BITBLT
953     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
954            blt_rop,
955            s->cirrus_blt_mode,
956            s->cirrus_blt_modeext,
957            s->cirrus_blt_width,
958            s->cirrus_blt_height,
959            s->cirrus_blt_dstpitch,
960            s->cirrus_blt_srcpitch,
961            s->cirrus_blt_dstaddr,
962            s->cirrus_blt_srcaddr,
963            s->vga.gr[0x2f]);
964 #endif
965 
966     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
967     case CIRRUS_BLTMODE_PIXELWIDTH8:
968 	s->cirrus_blt_pixelwidth = 1;
969 	break;
970     case CIRRUS_BLTMODE_PIXELWIDTH16:
971 	s->cirrus_blt_pixelwidth = 2;
972 	break;
973     case CIRRUS_BLTMODE_PIXELWIDTH24:
974 	s->cirrus_blt_pixelwidth = 3;
975 	break;
976     case CIRRUS_BLTMODE_PIXELWIDTH32:
977 	s->cirrus_blt_pixelwidth = 4;
978 	break;
979     default:
980 #ifdef DEBUG_BITBLT
981 	printf("cirrus: bitblt - pixel width is unknown\n");
982 #endif
983 	goto bitblt_ignore;
984     }
985     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
986 
987     if ((s->
988 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
989 			    CIRRUS_BLTMODE_MEMSYSDEST))
990 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
991 #ifdef DEBUG_BITBLT
992 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
993 #endif
994 	goto bitblt_ignore;
995     }
996 
997     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
998         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
999                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
1000                                CIRRUS_BLTMODE_PATTERNCOPY |
1001                                CIRRUS_BLTMODE_COLOREXPAND)) ==
1002          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
1003         cirrus_bitblt_fgcol(s);
1004         cirrus_bitblt_solidfill(s, blt_rop);
1005     } else {
1006         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
1007                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
1008             CIRRUS_BLTMODE_COLOREXPAND) {
1009 
1010             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1011                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1012                     cirrus_bitblt_bgcol(s);
1013                 else
1014                     cirrus_bitblt_fgcol(s);
1015                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1016             } else {
1017                 cirrus_bitblt_fgcol(s);
1018                 cirrus_bitblt_bgcol(s);
1019                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1020             }
1021         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1022             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1023                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1024                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1025                         cirrus_bitblt_bgcol(s);
1026                     else
1027                         cirrus_bitblt_fgcol(s);
1028                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1029                 } else {
1030                     cirrus_bitblt_fgcol(s);
1031                     cirrus_bitblt_bgcol(s);
1032                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1033                 }
1034             } else {
1035                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1036             }
1037         } else {
1038 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1039 		if (s->cirrus_blt_pixelwidth > 2) {
1040 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1041 		    goto bitblt_ignore;
1042 		}
1043 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1044 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1045 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1046 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1047 		} else {
1048 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1049 		}
1050 	    } else {
1051 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1052 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1053 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1054 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1055 		} else {
1056 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1057 		}
1058 	    }
1059 	}
1060         // setup bitblt engine.
1061         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1062             if (!cirrus_bitblt_cputovideo(s))
1063                 goto bitblt_ignore;
1064         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1065             if (!cirrus_bitblt_videotocpu(s))
1066                 goto bitblt_ignore;
1067         } else {
1068             if (!cirrus_bitblt_videotovideo(s))
1069                 goto bitblt_ignore;
1070         }
1071     }
1072     return;
1073   bitblt_ignore:;
1074     cirrus_bitblt_reset(s);
1075 }
1076 
1077 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1078 {
1079     unsigned old_value;
1080 
1081     old_value = s->vga.gr[0x31];
1082     s->vga.gr[0x31] = reg_value;
1083 
1084     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1085 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1086 	cirrus_bitblt_reset(s);
1087     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1088 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1089 	cirrus_bitblt_start(s);
1090     }
1091 }
1092 
1093 
1094 /***************************************
1095  *
1096  *  basic parameters
1097  *
1098  ***************************************/
1099 
1100 static void cirrus_get_offsets(VGACommonState *s1,
1101                                uint32_t *pline_offset,
1102                                uint32_t *pstart_addr,
1103                                uint32_t *pline_compare)
1104 {
1105     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1106     uint32_t start_addr, line_offset, line_compare;
1107 
1108     line_offset = s->vga.cr[0x13]
1109 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1110     line_offset <<= 3;
1111     *pline_offset = line_offset;
1112 
1113     start_addr = (s->vga.cr[0x0c] << 8)
1114 	| s->vga.cr[0x0d]
1115 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1116 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1117 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1118     *pstart_addr = start_addr;
1119 
1120     line_compare = s->vga.cr[0x18] |
1121         ((s->vga.cr[0x07] & 0x10) << 4) |
1122         ((s->vga.cr[0x09] & 0x40) << 3);
1123     *pline_compare = line_compare;
1124 }
1125 
1126 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1127 {
1128     uint32_t ret = 16;
1129 
1130     switch (s->cirrus_hidden_dac_data & 0xf) {
1131     case 0:
1132 	ret = 15;
1133 	break;			/* Sierra HiColor */
1134     case 1:
1135 	ret = 16;
1136 	break;			/* XGA HiColor */
1137     default:
1138 #ifdef DEBUG_CIRRUS
1139 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1140 	       (s->cirrus_hidden_dac_data & 0xf));
1141 #endif
1142 	ret = 15;		/* XXX */
1143 	break;
1144     }
1145     return ret;
1146 }
1147 
1148 static int cirrus_get_bpp(VGACommonState *s1)
1149 {
1150     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1151     uint32_t ret = 8;
1152 
1153     if ((s->vga.sr[0x07] & 0x01) != 0) {
1154 	/* Cirrus SVGA */
1155 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1156 	case CIRRUS_SR7_BPP_8:
1157 	    ret = 8;
1158 	    break;
1159 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1160 	    ret = cirrus_get_bpp16_depth(s);
1161 	    break;
1162 	case CIRRUS_SR7_BPP_24:
1163 	    ret = 24;
1164 	    break;
1165 	case CIRRUS_SR7_BPP_16:
1166 	    ret = cirrus_get_bpp16_depth(s);
1167 	    break;
1168 	case CIRRUS_SR7_BPP_32:
1169 	    ret = 32;
1170 	    break;
1171 	default:
1172 #ifdef DEBUG_CIRRUS
1173 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1174 #endif
1175 	    ret = 8;
1176 	    break;
1177 	}
1178     } else {
1179 	/* VGA */
1180 	ret = 0;
1181     }
1182 
1183     return ret;
1184 }
1185 
1186 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1187 {
1188     int width, height;
1189 
1190     width = (s->cr[0x01] + 1) * 8;
1191     height = s->cr[0x12] |
1192         ((s->cr[0x07] & 0x02) << 7) |
1193         ((s->cr[0x07] & 0x40) << 3);
1194     height = (height + 1);
1195     /* interlace support */
1196     if (s->cr[0x1a] & 0x01)
1197         height = height * 2;
1198     *pwidth = width;
1199     *pheight = height;
1200 }
1201 
1202 /***************************************
1203  *
1204  * bank memory
1205  *
1206  ***************************************/
1207 
1208 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1209 {
1210     unsigned offset;
1211     unsigned limit;
1212 
1213     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1214 	offset = s->vga.gr[0x09 + bank_index];
1215     else			/* single bank */
1216 	offset = s->vga.gr[0x09];
1217 
1218     if ((s->vga.gr[0x0b] & 0x20) != 0)
1219 	offset <<= 14;
1220     else
1221 	offset <<= 12;
1222 
1223     if (s->real_vram_size <= offset)
1224 	limit = 0;
1225     else
1226 	limit = s->real_vram_size - offset;
1227 
1228     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1229 	if (limit > 0x8000) {
1230 	    offset += 0x8000;
1231 	    limit -= 0x8000;
1232 	} else {
1233 	    limit = 0;
1234 	}
1235     }
1236 
1237     if (limit > 0) {
1238 	s->cirrus_bank_base[bank_index] = offset;
1239 	s->cirrus_bank_limit[bank_index] = limit;
1240     } else {
1241 	s->cirrus_bank_base[bank_index] = 0;
1242 	s->cirrus_bank_limit[bank_index] = 0;
1243     }
1244 }
1245 
1246 /***************************************
1247  *
1248  *  I/O access between 0x3c4-0x3c5
1249  *
1250  ***************************************/
1251 
1252 static int cirrus_vga_read_sr(CirrusVGAState * s)
1253 {
1254     switch (s->vga.sr_index) {
1255     case 0x00:			// Standard VGA
1256     case 0x01:			// Standard VGA
1257     case 0x02:			// Standard VGA
1258     case 0x03:			// Standard VGA
1259     case 0x04:			// Standard VGA
1260 	return s->vga.sr[s->vga.sr_index];
1261     case 0x06:			// Unlock Cirrus extensions
1262 	return s->vga.sr[s->vga.sr_index];
1263     case 0x10:
1264     case 0x30:
1265     case 0x50:
1266     case 0x70:			// Graphics Cursor X
1267     case 0x90:
1268     case 0xb0:
1269     case 0xd0:
1270     case 0xf0:			// Graphics Cursor X
1271 	return s->vga.sr[0x10];
1272     case 0x11:
1273     case 0x31:
1274     case 0x51:
1275     case 0x71:			// Graphics Cursor Y
1276     case 0x91:
1277     case 0xb1:
1278     case 0xd1:
1279     case 0xf1:			// Graphics Cursor Y
1280 	return s->vga.sr[0x11];
1281     case 0x05:			// ???
1282     case 0x07:			// Extended Sequencer Mode
1283     case 0x08:			// EEPROM Control
1284     case 0x09:			// Scratch Register 0
1285     case 0x0a:			// Scratch Register 1
1286     case 0x0b:			// VCLK 0
1287     case 0x0c:			// VCLK 1
1288     case 0x0d:			// VCLK 2
1289     case 0x0e:			// VCLK 3
1290     case 0x0f:			// DRAM Control
1291     case 0x12:			// Graphics Cursor Attribute
1292     case 0x13:			// Graphics Cursor Pattern Address
1293     case 0x14:			// Scratch Register 2
1294     case 0x15:			// Scratch Register 3
1295     case 0x16:			// Performance Tuning Register
1296     case 0x17:			// Configuration Readback and Extended Control
1297     case 0x18:			// Signature Generator Control
1298     case 0x19:			// Signal Generator Result
1299     case 0x1a:			// Signal Generator Result
1300     case 0x1b:			// VCLK 0 Denominator & Post
1301     case 0x1c:			// VCLK 1 Denominator & Post
1302     case 0x1d:			// VCLK 2 Denominator & Post
1303     case 0x1e:			// VCLK 3 Denominator & Post
1304     case 0x1f:			// BIOS Write Enable and MCLK select
1305 #ifdef DEBUG_CIRRUS
1306 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1307 #endif
1308 	return s->vga.sr[s->vga.sr_index];
1309     default:
1310 #ifdef DEBUG_CIRRUS
1311 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1312 #endif
1313 	return 0xff;
1314 	break;
1315     }
1316 }
1317 
1318 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1319 {
1320     switch (s->vga.sr_index) {
1321     case 0x00:			// Standard VGA
1322     case 0x01:			// Standard VGA
1323     case 0x02:			// Standard VGA
1324     case 0x03:			// Standard VGA
1325     case 0x04:			// Standard VGA
1326 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1327 	if (s->vga.sr_index == 1)
1328             s->vga.update_retrace_info(&s->vga);
1329         break;
1330     case 0x06:			// Unlock Cirrus extensions
1331 	val &= 0x17;
1332 	if (val == 0x12) {
1333 	    s->vga.sr[s->vga.sr_index] = 0x12;
1334 	} else {
1335 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1336 	}
1337 	break;
1338     case 0x10:
1339     case 0x30:
1340     case 0x50:
1341     case 0x70:			// Graphics Cursor X
1342     case 0x90:
1343     case 0xb0:
1344     case 0xd0:
1345     case 0xf0:			// Graphics Cursor X
1346 	s->vga.sr[0x10] = val;
1347         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1348 	break;
1349     case 0x11:
1350     case 0x31:
1351     case 0x51:
1352     case 0x71:			// Graphics Cursor Y
1353     case 0x91:
1354     case 0xb1:
1355     case 0xd1:
1356     case 0xf1:			// Graphics Cursor Y
1357 	s->vga.sr[0x11] = val;
1358         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1359 	break;
1360     case 0x07:			// Extended Sequencer Mode
1361         cirrus_update_memory_access(s);
1362         /* fall through */
1363     case 0x08:			// EEPROM Control
1364     case 0x09:			// Scratch Register 0
1365     case 0x0a:			// Scratch Register 1
1366     case 0x0b:			// VCLK 0
1367     case 0x0c:			// VCLK 1
1368     case 0x0d:			// VCLK 2
1369     case 0x0e:			// VCLK 3
1370     case 0x0f:			// DRAM Control
1371     case 0x13:			// Graphics Cursor Pattern Address
1372     case 0x14:			// Scratch Register 2
1373     case 0x15:			// Scratch Register 3
1374     case 0x16:			// Performance Tuning Register
1375     case 0x18:			// Signature Generator Control
1376     case 0x19:			// Signature Generator Result
1377     case 0x1a:			// Signature Generator Result
1378     case 0x1b:			// VCLK 0 Denominator & Post
1379     case 0x1c:			// VCLK 1 Denominator & Post
1380     case 0x1d:			// VCLK 2 Denominator & Post
1381     case 0x1e:			// VCLK 3 Denominator & Post
1382     case 0x1f:			// BIOS Write Enable and MCLK select
1383 	s->vga.sr[s->vga.sr_index] = val;
1384 #ifdef DEBUG_CIRRUS
1385 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1386 	       s->vga.sr_index, val);
1387 #endif
1388 	break;
1389     case 0x12:			// Graphics Cursor Attribute
1390 	s->vga.sr[0x12] = val;
1391         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1392 #ifdef DEBUG_CIRRUS
1393         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1394                val, s->vga.force_shadow);
1395 #endif
1396         break;
1397     case 0x17:			// Configuration Readback and Extended Control
1398 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1399                                    | (val & 0xc7);
1400         cirrus_update_memory_access(s);
1401         break;
1402     default:
1403 #ifdef DEBUG_CIRRUS
1404 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1405                s->vga.sr_index, val);
1406 #endif
1407 	break;
1408     }
1409 }
1410 
1411 /***************************************
1412  *
1413  *  I/O access at 0x3c6
1414  *
1415  ***************************************/
1416 
1417 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1418 {
1419     if (++s->cirrus_hidden_dac_lockindex == 5) {
1420         s->cirrus_hidden_dac_lockindex = 0;
1421         return s->cirrus_hidden_dac_data;
1422     }
1423     return 0xff;
1424 }
1425 
1426 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1427 {
1428     if (s->cirrus_hidden_dac_lockindex == 4) {
1429 	s->cirrus_hidden_dac_data = reg_value;
1430 #if defined(DEBUG_CIRRUS)
1431 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1432 #endif
1433     }
1434     s->cirrus_hidden_dac_lockindex = 0;
1435 }
1436 
1437 /***************************************
1438  *
1439  *  I/O access at 0x3c9
1440  *
1441  ***************************************/
1442 
1443 static int cirrus_vga_read_palette(CirrusVGAState * s)
1444 {
1445     int val;
1446 
1447     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1448         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1449                                        s->vga.dac_sub_index];
1450     } else {
1451         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1452     }
1453     if (++s->vga.dac_sub_index == 3) {
1454 	s->vga.dac_sub_index = 0;
1455 	s->vga.dac_read_index++;
1456     }
1457     return val;
1458 }
1459 
1460 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1461 {
1462     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1463     if (++s->vga.dac_sub_index == 3) {
1464         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1465             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1466                    s->vga.dac_cache, 3);
1467         } else {
1468             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1469         }
1470         /* XXX update cursor */
1471 	s->vga.dac_sub_index = 0;
1472 	s->vga.dac_write_index++;
1473     }
1474 }
1475 
1476 /***************************************
1477  *
1478  *  I/O access between 0x3ce-0x3cf
1479  *
1480  ***************************************/
1481 
1482 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1483 {
1484     switch (reg_index) {
1485     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1486         return s->cirrus_shadow_gr0;
1487     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1488         return s->cirrus_shadow_gr1;
1489     case 0x02:			// Standard VGA
1490     case 0x03:			// Standard VGA
1491     case 0x04:			// Standard VGA
1492     case 0x06:			// Standard VGA
1493     case 0x07:			// Standard VGA
1494     case 0x08:			// Standard VGA
1495         return s->vga.gr[s->vga.gr_index];
1496     case 0x05:			// Standard VGA, Cirrus extended mode
1497     default:
1498 	break;
1499     }
1500 
1501     if (reg_index < 0x3a) {
1502 	return s->vga.gr[reg_index];
1503     } else {
1504 #ifdef DEBUG_CIRRUS
1505 	printf("cirrus: inport gr_index %02x\n", reg_index);
1506 #endif
1507 	return 0xff;
1508     }
1509 }
1510 
1511 static void
1512 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1513 {
1514 #if defined(DEBUG_BITBLT) && 0
1515     printf("gr%02x: %02x\n", reg_index, reg_value);
1516 #endif
1517     switch (reg_index) {
1518     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1519 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1520 	s->cirrus_shadow_gr0 = reg_value;
1521 	break;
1522     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1523 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1524 	s->cirrus_shadow_gr1 = reg_value;
1525 	break;
1526     case 0x02:			// Standard VGA
1527     case 0x03:			// Standard VGA
1528     case 0x04:			// Standard VGA
1529     case 0x06:			// Standard VGA
1530     case 0x07:			// Standard VGA
1531     case 0x08:			// Standard VGA
1532 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1533         break;
1534     case 0x05:			// Standard VGA, Cirrus extended mode
1535 	s->vga.gr[reg_index] = reg_value & 0x7f;
1536         cirrus_update_memory_access(s);
1537 	break;
1538     case 0x09:			// bank offset #0
1539     case 0x0A:			// bank offset #1
1540 	s->vga.gr[reg_index] = reg_value;
1541 	cirrus_update_bank_ptr(s, 0);
1542 	cirrus_update_bank_ptr(s, 1);
1543         cirrus_update_memory_access(s);
1544         break;
1545     case 0x0B:
1546 	s->vga.gr[reg_index] = reg_value;
1547 	cirrus_update_bank_ptr(s, 0);
1548 	cirrus_update_bank_ptr(s, 1);
1549         cirrus_update_memory_access(s);
1550 	break;
1551     case 0x10:			// BGCOLOR 0x0000ff00
1552     case 0x11:			// FGCOLOR 0x0000ff00
1553     case 0x12:			// BGCOLOR 0x00ff0000
1554     case 0x13:			// FGCOLOR 0x00ff0000
1555     case 0x14:			// BGCOLOR 0xff000000
1556     case 0x15:			// FGCOLOR 0xff000000
1557     case 0x20:			// BLT WIDTH 0x0000ff
1558     case 0x22:			// BLT HEIGHT 0x0000ff
1559     case 0x24:			// BLT DEST PITCH 0x0000ff
1560     case 0x26:			// BLT SRC PITCH 0x0000ff
1561     case 0x28:			// BLT DEST ADDR 0x0000ff
1562     case 0x29:			// BLT DEST ADDR 0x00ff00
1563     case 0x2c:			// BLT SRC ADDR 0x0000ff
1564     case 0x2d:			// BLT SRC ADDR 0x00ff00
1565     case 0x2f:                  // BLT WRITEMASK
1566     case 0x30:			// BLT MODE
1567     case 0x32:			// RASTER OP
1568     case 0x33:			// BLT MODEEXT
1569     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1570     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1571     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1572     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1573 	s->vga.gr[reg_index] = reg_value;
1574 	break;
1575     case 0x21:			// BLT WIDTH 0x001f00
1576     case 0x23:			// BLT HEIGHT 0x001f00
1577     case 0x25:			// BLT DEST PITCH 0x001f00
1578     case 0x27:			// BLT SRC PITCH 0x001f00
1579 	s->vga.gr[reg_index] = reg_value & 0x1f;
1580 	break;
1581     case 0x2a:			// BLT DEST ADDR 0x3f0000
1582 	s->vga.gr[reg_index] = reg_value & 0x3f;
1583         /* if auto start mode, starts bit blt now */
1584         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1585             cirrus_bitblt_start(s);
1586         }
1587 	break;
1588     case 0x2e:			// BLT SRC ADDR 0x3f0000
1589 	s->vga.gr[reg_index] = reg_value & 0x3f;
1590 	break;
1591     case 0x31:			// BLT STATUS/START
1592 	cirrus_write_bitblt(s, reg_value);
1593 	break;
1594     default:
1595 #ifdef DEBUG_CIRRUS
1596 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1597 	       reg_value);
1598 #endif
1599 	break;
1600     }
1601 }
1602 
1603 /***************************************
1604  *
1605  *  I/O access between 0x3d4-0x3d5
1606  *
1607  ***************************************/
1608 
1609 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1610 {
1611     switch (reg_index) {
1612     case 0x00:			// Standard VGA
1613     case 0x01:			// Standard VGA
1614     case 0x02:			// Standard VGA
1615     case 0x03:			// Standard VGA
1616     case 0x04:			// Standard VGA
1617     case 0x05:			// Standard VGA
1618     case 0x06:			// Standard VGA
1619     case 0x07:			// Standard VGA
1620     case 0x08:			// Standard VGA
1621     case 0x09:			// Standard VGA
1622     case 0x0a:			// Standard VGA
1623     case 0x0b:			// Standard VGA
1624     case 0x0c:			// Standard VGA
1625     case 0x0d:			// Standard VGA
1626     case 0x0e:			// Standard VGA
1627     case 0x0f:			// Standard VGA
1628     case 0x10:			// Standard VGA
1629     case 0x11:			// Standard VGA
1630     case 0x12:			// Standard VGA
1631     case 0x13:			// Standard VGA
1632     case 0x14:			// Standard VGA
1633     case 0x15:			// Standard VGA
1634     case 0x16:			// Standard VGA
1635     case 0x17:			// Standard VGA
1636     case 0x18:			// Standard VGA
1637 	return s->vga.cr[s->vga.cr_index];
1638     case 0x24:			// Attribute Controller Toggle Readback (R)
1639         return (s->vga.ar_flip_flop << 7);
1640     case 0x19:			// Interlace End
1641     case 0x1a:			// Miscellaneous Control
1642     case 0x1b:			// Extended Display Control
1643     case 0x1c:			// Sync Adjust and Genlock
1644     case 0x1d:			// Overlay Extended Control
1645     case 0x22:			// Graphics Data Latches Readback (R)
1646     case 0x25:			// Part Status
1647     case 0x27:			// Part ID (R)
1648 	return s->vga.cr[s->vga.cr_index];
1649     case 0x26:			// Attribute Controller Index Readback (R)
1650 	return s->vga.ar_index & 0x3f;
1651 	break;
1652     default:
1653 #ifdef DEBUG_CIRRUS
1654 	printf("cirrus: inport cr_index %02x\n", reg_index);
1655 #endif
1656 	return 0xff;
1657     }
1658 }
1659 
1660 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1661 {
1662     switch (s->vga.cr_index) {
1663     case 0x00:			// Standard VGA
1664     case 0x01:			// Standard VGA
1665     case 0x02:			// Standard VGA
1666     case 0x03:			// Standard VGA
1667     case 0x04:			// Standard VGA
1668     case 0x05:			// Standard VGA
1669     case 0x06:			// Standard VGA
1670     case 0x07:			// Standard VGA
1671     case 0x08:			// Standard VGA
1672     case 0x09:			// Standard VGA
1673     case 0x0a:			// Standard VGA
1674     case 0x0b:			// Standard VGA
1675     case 0x0c:			// Standard VGA
1676     case 0x0d:			// Standard VGA
1677     case 0x0e:			// Standard VGA
1678     case 0x0f:			// Standard VGA
1679     case 0x10:			// Standard VGA
1680     case 0x11:			// Standard VGA
1681     case 0x12:			// Standard VGA
1682     case 0x13:			// Standard VGA
1683     case 0x14:			// Standard VGA
1684     case 0x15:			// Standard VGA
1685     case 0x16:			// Standard VGA
1686     case 0x17:			// Standard VGA
1687     case 0x18:			// Standard VGA
1688 	/* handle CR0-7 protection */
1689 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1690 	    /* can always write bit 4 of CR7 */
1691 	    if (s->vga.cr_index == 7)
1692 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1693 	    return;
1694 	}
1695 	s->vga.cr[s->vga.cr_index] = reg_value;
1696 	switch(s->vga.cr_index) {
1697 	case 0x00:
1698 	case 0x04:
1699 	case 0x05:
1700 	case 0x06:
1701 	case 0x07:
1702 	case 0x11:
1703 	case 0x17:
1704 	    s->vga.update_retrace_info(&s->vga);
1705 	    break;
1706 	}
1707         break;
1708     case 0x19:			// Interlace End
1709     case 0x1a:			// Miscellaneous Control
1710     case 0x1b:			// Extended Display Control
1711     case 0x1c:			// Sync Adjust and Genlock
1712     case 0x1d:			// Overlay Extended Control
1713 	s->vga.cr[s->vga.cr_index] = reg_value;
1714 #ifdef DEBUG_CIRRUS
1715 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1716 	       s->vga.cr_index, reg_value);
1717 #endif
1718 	break;
1719     case 0x22:			// Graphics Data Latches Readback (R)
1720     case 0x24:			// Attribute Controller Toggle Readback (R)
1721     case 0x26:			// Attribute Controller Index Readback (R)
1722     case 0x27:			// Part ID (R)
1723 	break;
1724     case 0x25:			// Part Status
1725     default:
1726 #ifdef DEBUG_CIRRUS
1727 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1728                s->vga.cr_index, reg_value);
1729 #endif
1730 	break;
1731     }
1732 }
1733 
1734 /***************************************
1735  *
1736  *  memory-mapped I/O (bitblt)
1737  *
1738  ***************************************/
1739 
1740 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1741 {
1742     int value = 0xff;
1743 
1744     switch (address) {
1745     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1746 	value = cirrus_vga_read_gr(s, 0x00);
1747 	break;
1748     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1749 	value = cirrus_vga_read_gr(s, 0x10);
1750 	break;
1751     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1752 	value = cirrus_vga_read_gr(s, 0x12);
1753 	break;
1754     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1755 	value = cirrus_vga_read_gr(s, 0x14);
1756 	break;
1757     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1758 	value = cirrus_vga_read_gr(s, 0x01);
1759 	break;
1760     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1761 	value = cirrus_vga_read_gr(s, 0x11);
1762 	break;
1763     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1764 	value = cirrus_vga_read_gr(s, 0x13);
1765 	break;
1766     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1767 	value = cirrus_vga_read_gr(s, 0x15);
1768 	break;
1769     case (CIRRUS_MMIO_BLTWIDTH + 0):
1770 	value = cirrus_vga_read_gr(s, 0x20);
1771 	break;
1772     case (CIRRUS_MMIO_BLTWIDTH + 1):
1773 	value = cirrus_vga_read_gr(s, 0x21);
1774 	break;
1775     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1776 	value = cirrus_vga_read_gr(s, 0x22);
1777 	break;
1778     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1779 	value = cirrus_vga_read_gr(s, 0x23);
1780 	break;
1781     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1782 	value = cirrus_vga_read_gr(s, 0x24);
1783 	break;
1784     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1785 	value = cirrus_vga_read_gr(s, 0x25);
1786 	break;
1787     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1788 	value = cirrus_vga_read_gr(s, 0x26);
1789 	break;
1790     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1791 	value = cirrus_vga_read_gr(s, 0x27);
1792 	break;
1793     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1794 	value = cirrus_vga_read_gr(s, 0x28);
1795 	break;
1796     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1797 	value = cirrus_vga_read_gr(s, 0x29);
1798 	break;
1799     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1800 	value = cirrus_vga_read_gr(s, 0x2a);
1801 	break;
1802     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1803 	value = cirrus_vga_read_gr(s, 0x2c);
1804 	break;
1805     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1806 	value = cirrus_vga_read_gr(s, 0x2d);
1807 	break;
1808     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1809 	value = cirrus_vga_read_gr(s, 0x2e);
1810 	break;
1811     case CIRRUS_MMIO_BLTWRITEMASK:
1812 	value = cirrus_vga_read_gr(s, 0x2f);
1813 	break;
1814     case CIRRUS_MMIO_BLTMODE:
1815 	value = cirrus_vga_read_gr(s, 0x30);
1816 	break;
1817     case CIRRUS_MMIO_BLTROP:
1818 	value = cirrus_vga_read_gr(s, 0x32);
1819 	break;
1820     case CIRRUS_MMIO_BLTMODEEXT:
1821 	value = cirrus_vga_read_gr(s, 0x33);
1822 	break;
1823     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1824 	value = cirrus_vga_read_gr(s, 0x34);
1825 	break;
1826     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1827 	value = cirrus_vga_read_gr(s, 0x35);
1828 	break;
1829     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1830 	value = cirrus_vga_read_gr(s, 0x38);
1831 	break;
1832     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1833 	value = cirrus_vga_read_gr(s, 0x39);
1834 	break;
1835     case CIRRUS_MMIO_BLTSTATUS:
1836 	value = cirrus_vga_read_gr(s, 0x31);
1837 	break;
1838     default:
1839 #ifdef DEBUG_CIRRUS
1840 	printf("cirrus: mmio read - address 0x%04x\n", address);
1841 #endif
1842 	break;
1843     }
1844 
1845     trace_vga_cirrus_write_blt(address, value);
1846     return (uint8_t) value;
1847 }
1848 
1849 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1850 				  uint8_t value)
1851 {
1852     trace_vga_cirrus_write_blt(address, value);
1853     switch (address) {
1854     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1855 	cirrus_vga_write_gr(s, 0x00, value);
1856 	break;
1857     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1858 	cirrus_vga_write_gr(s, 0x10, value);
1859 	break;
1860     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1861 	cirrus_vga_write_gr(s, 0x12, value);
1862 	break;
1863     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1864 	cirrus_vga_write_gr(s, 0x14, value);
1865 	break;
1866     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1867 	cirrus_vga_write_gr(s, 0x01, value);
1868 	break;
1869     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1870 	cirrus_vga_write_gr(s, 0x11, value);
1871 	break;
1872     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1873 	cirrus_vga_write_gr(s, 0x13, value);
1874 	break;
1875     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1876 	cirrus_vga_write_gr(s, 0x15, value);
1877 	break;
1878     case (CIRRUS_MMIO_BLTWIDTH + 0):
1879 	cirrus_vga_write_gr(s, 0x20, value);
1880 	break;
1881     case (CIRRUS_MMIO_BLTWIDTH + 1):
1882 	cirrus_vga_write_gr(s, 0x21, value);
1883 	break;
1884     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1885 	cirrus_vga_write_gr(s, 0x22, value);
1886 	break;
1887     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1888 	cirrus_vga_write_gr(s, 0x23, value);
1889 	break;
1890     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1891 	cirrus_vga_write_gr(s, 0x24, value);
1892 	break;
1893     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1894 	cirrus_vga_write_gr(s, 0x25, value);
1895 	break;
1896     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1897 	cirrus_vga_write_gr(s, 0x26, value);
1898 	break;
1899     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1900 	cirrus_vga_write_gr(s, 0x27, value);
1901 	break;
1902     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1903 	cirrus_vga_write_gr(s, 0x28, value);
1904 	break;
1905     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1906 	cirrus_vga_write_gr(s, 0x29, value);
1907 	break;
1908     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1909 	cirrus_vga_write_gr(s, 0x2a, value);
1910 	break;
1911     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1912 	/* ignored */
1913 	break;
1914     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1915 	cirrus_vga_write_gr(s, 0x2c, value);
1916 	break;
1917     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1918 	cirrus_vga_write_gr(s, 0x2d, value);
1919 	break;
1920     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1921 	cirrus_vga_write_gr(s, 0x2e, value);
1922 	break;
1923     case CIRRUS_MMIO_BLTWRITEMASK:
1924 	cirrus_vga_write_gr(s, 0x2f, value);
1925 	break;
1926     case CIRRUS_MMIO_BLTMODE:
1927 	cirrus_vga_write_gr(s, 0x30, value);
1928 	break;
1929     case CIRRUS_MMIO_BLTROP:
1930 	cirrus_vga_write_gr(s, 0x32, value);
1931 	break;
1932     case CIRRUS_MMIO_BLTMODEEXT:
1933 	cirrus_vga_write_gr(s, 0x33, value);
1934 	break;
1935     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1936 	cirrus_vga_write_gr(s, 0x34, value);
1937 	break;
1938     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1939 	cirrus_vga_write_gr(s, 0x35, value);
1940 	break;
1941     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1942 	cirrus_vga_write_gr(s, 0x38, value);
1943 	break;
1944     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1945 	cirrus_vga_write_gr(s, 0x39, value);
1946 	break;
1947     case CIRRUS_MMIO_BLTSTATUS:
1948 	cirrus_vga_write_gr(s, 0x31, value);
1949 	break;
1950     default:
1951 #ifdef DEBUG_CIRRUS
1952 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1953 	       address, value);
1954 #endif
1955 	break;
1956     }
1957 }
1958 
1959 /***************************************
1960  *
1961  *  write mode 4/5
1962  *
1963  ***************************************/
1964 
1965 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1966 					     unsigned mode,
1967 					     unsigned offset,
1968 					     uint32_t mem_value)
1969 {
1970     int x;
1971     unsigned val = mem_value;
1972     uint8_t *dst;
1973 
1974     for (x = 0; x < 8; x++) {
1975         dst = s->vga.vram_ptr + ((offset + x) & s->cirrus_addr_mask);
1976 	if (val & 0x80) {
1977 	    *dst = s->cirrus_shadow_gr1;
1978 	} else if (mode == 5) {
1979 	    *dst = s->cirrus_shadow_gr0;
1980 	}
1981 	val <<= 1;
1982     }
1983     memory_region_set_dirty(&s->vga.vram, offset, 8);
1984 }
1985 
1986 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1987 					      unsigned mode,
1988 					      unsigned offset,
1989 					      uint32_t mem_value)
1990 {
1991     int x;
1992     unsigned val = mem_value;
1993     uint8_t *dst;
1994 
1995     for (x = 0; x < 8; x++) {
1996         dst = s->vga.vram_ptr + ((offset + 2 * x) & s->cirrus_addr_mask & ~1);
1997 	if (val & 0x80) {
1998 	    *dst = s->cirrus_shadow_gr1;
1999 	    *(dst + 1) = s->vga.gr[0x11];
2000 	} else if (mode == 5) {
2001 	    *dst = s->cirrus_shadow_gr0;
2002 	    *(dst + 1) = s->vga.gr[0x10];
2003 	}
2004 	val <<= 1;
2005     }
2006     memory_region_set_dirty(&s->vga.vram, offset, 16);
2007 }
2008 
2009 /***************************************
2010  *
2011  *  memory access between 0xa0000-0xbffff
2012  *
2013  ***************************************/
2014 
2015 static uint64_t cirrus_vga_mem_read(void *opaque,
2016                                     hwaddr addr,
2017                                     uint32_t size)
2018 {
2019     CirrusVGAState *s = opaque;
2020     unsigned bank_index;
2021     unsigned bank_offset;
2022     uint32_t val;
2023 
2024     if ((s->vga.sr[0x07] & 0x01) == 0) {
2025         return vga_mem_readb(&s->vga, addr);
2026     }
2027 
2028     if (addr < 0x10000) {
2029 	/* XXX handle bitblt */
2030 	/* video memory */
2031 	bank_index = addr >> 15;
2032 	bank_offset = addr & 0x7fff;
2033 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2034 	    bank_offset += s->cirrus_bank_base[bank_index];
2035 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2036 		bank_offset <<= 4;
2037 	    } else if (s->vga.gr[0x0B] & 0x02) {
2038 		bank_offset <<= 3;
2039 	    }
2040 	    bank_offset &= s->cirrus_addr_mask;
2041 	    val = *(s->vga.vram_ptr + bank_offset);
2042 	} else
2043 	    val = 0xff;
2044     } else if (addr >= 0x18000 && addr < 0x18100) {
2045 	/* memory-mapped I/O */
2046 	val = 0xff;
2047 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2048 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
2049 	}
2050     } else {
2051 	val = 0xff;
2052 #ifdef DEBUG_CIRRUS
2053 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2054 #endif
2055     }
2056     return val;
2057 }
2058 
2059 static void cirrus_vga_mem_write(void *opaque,
2060                                  hwaddr addr,
2061                                  uint64_t mem_value,
2062                                  uint32_t size)
2063 {
2064     CirrusVGAState *s = opaque;
2065     unsigned bank_index;
2066     unsigned bank_offset;
2067     unsigned mode;
2068 
2069     if ((s->vga.sr[0x07] & 0x01) == 0) {
2070         vga_mem_writeb(&s->vga, addr, mem_value);
2071         return;
2072     }
2073 
2074     if (addr < 0x10000) {
2075 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2076 	    /* bitblt */
2077 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2078 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2079 		cirrus_bitblt_cputovideo_next(s);
2080 	    }
2081 	} else {
2082 	    /* video memory */
2083 	    bank_index = addr >> 15;
2084 	    bank_offset = addr & 0x7fff;
2085 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2086 		bank_offset += s->cirrus_bank_base[bank_index];
2087 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2088 		    bank_offset <<= 4;
2089 		} else if (s->vga.gr[0x0B] & 0x02) {
2090 		    bank_offset <<= 3;
2091 		}
2092 		bank_offset &= s->cirrus_addr_mask;
2093 		mode = s->vga.gr[0x05] & 0x7;
2094 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2095 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2096                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2097                                             sizeof(mem_value));
2098 		} else {
2099 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2100 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2101 							 bank_offset,
2102 							 mem_value);
2103 		    } else {
2104 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2105 							  bank_offset,
2106 							  mem_value);
2107 		    }
2108 		}
2109 	    }
2110 	}
2111     } else if (addr >= 0x18000 && addr < 0x18100) {
2112 	/* memory-mapped I/O */
2113 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2114 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2115 	}
2116     } else {
2117 #ifdef DEBUG_CIRRUS
2118         printf("cirrus: mem_writeb " TARGET_FMT_plx " value 0x%02" PRIu64 "\n", addr,
2119                mem_value);
2120 #endif
2121     }
2122 }
2123 
2124 static const MemoryRegionOps cirrus_vga_mem_ops = {
2125     .read = cirrus_vga_mem_read,
2126     .write = cirrus_vga_mem_write,
2127     .endianness = DEVICE_LITTLE_ENDIAN,
2128     .impl = {
2129         .min_access_size = 1,
2130         .max_access_size = 1,
2131     },
2132 };
2133 
2134 /***************************************
2135  *
2136  *  hardware cursor
2137  *
2138  ***************************************/
2139 
2140 static inline void invalidate_cursor1(CirrusVGAState *s)
2141 {
2142     if (s->last_hw_cursor_size) {
2143         vga_invalidate_scanlines(&s->vga,
2144                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2145                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2146     }
2147 }
2148 
2149 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2150 {
2151     const uint8_t *src;
2152     uint32_t content;
2153     int y, y_min, y_max;
2154 
2155     src = s->vga.vram_ptr + s->real_vram_size - 16 * KiB;
2156     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2157         src += (s->vga.sr[0x13] & 0x3c) * 256;
2158         y_min = 64;
2159         y_max = -1;
2160         for(y = 0; y < 64; y++) {
2161             content = ((uint32_t *)src)[0] |
2162                 ((uint32_t *)src)[1] |
2163                 ((uint32_t *)src)[2] |
2164                 ((uint32_t *)src)[3];
2165             if (content) {
2166                 if (y < y_min)
2167                     y_min = y;
2168                 if (y > y_max)
2169                     y_max = y;
2170             }
2171             src += 16;
2172         }
2173     } else {
2174         src += (s->vga.sr[0x13] & 0x3f) * 256;
2175         y_min = 32;
2176         y_max = -1;
2177         for(y = 0; y < 32; y++) {
2178             content = ((uint32_t *)src)[0] |
2179                 ((uint32_t *)(src + 128))[0];
2180             if (content) {
2181                 if (y < y_min)
2182                     y_min = y;
2183                 if (y > y_max)
2184                     y_max = y;
2185             }
2186             src += 4;
2187         }
2188     }
2189     if (y_min > y_max) {
2190         s->last_hw_cursor_y_start = 0;
2191         s->last_hw_cursor_y_end = 0;
2192     } else {
2193         s->last_hw_cursor_y_start = y_min;
2194         s->last_hw_cursor_y_end = y_max + 1;
2195     }
2196 }
2197 
2198 /* NOTE: we do not currently handle the cursor bitmap change, so we
2199    update the cursor only if it moves. */
2200 static void cirrus_cursor_invalidate(VGACommonState *s1)
2201 {
2202     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2203     int size;
2204 
2205     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2206         size = 0;
2207     } else {
2208         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2209             size = 64;
2210         else
2211             size = 32;
2212     }
2213     /* invalidate last cursor and new cursor if any change */
2214     if (s->last_hw_cursor_size != size ||
2215         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2216         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2217 
2218         invalidate_cursor1(s);
2219 
2220         s->last_hw_cursor_size = size;
2221         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2222         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2223         /* compute the real cursor min and max y */
2224         cirrus_cursor_compute_yrange(s);
2225         invalidate_cursor1(s);
2226     }
2227 }
2228 
2229 static void vga_draw_cursor_line(uint8_t *d1,
2230                                  const uint8_t *src1,
2231                                  int poffset, int w,
2232                                  unsigned int color0,
2233                                  unsigned int color1,
2234                                  unsigned int color_xor)
2235 {
2236     const uint8_t *plane0, *plane1;
2237     int x, b0, b1;
2238     uint8_t *d;
2239 
2240     d = d1;
2241     plane0 = src1;
2242     plane1 = src1 + poffset;
2243     for (x = 0; x < w; x++) {
2244         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2245         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2246         switch (b0 | (b1 << 1)) {
2247         case 0:
2248             break;
2249         case 1:
2250             ((uint32_t *)d)[0] ^= color_xor;
2251             break;
2252         case 2:
2253             ((uint32_t *)d)[0] = color0;
2254             break;
2255         case 3:
2256             ((uint32_t *)d)[0] = color1;
2257             break;
2258         }
2259         d += 4;
2260     }
2261 }
2262 
2263 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2264 {
2265     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2266     int w, h, x1, x2, poffset;
2267     unsigned int color0, color1;
2268     const uint8_t *palette, *src;
2269     uint32_t content;
2270 
2271     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2272         return;
2273     /* fast test to see if the cursor intersects with the scan line */
2274     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2275         h = 64;
2276     } else {
2277         h = 32;
2278     }
2279     if (scr_y < s->vga.hw_cursor_y ||
2280         scr_y >= (s->vga.hw_cursor_y + h)) {
2281         return;
2282     }
2283 
2284     src = s->vga.vram_ptr + s->real_vram_size - 16 * KiB;
2285     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2286         src += (s->vga.sr[0x13] & 0x3c) * 256;
2287         src += (scr_y - s->vga.hw_cursor_y) * 16;
2288         poffset = 8;
2289         content = ((uint32_t *)src)[0] |
2290             ((uint32_t *)src)[1] |
2291             ((uint32_t *)src)[2] |
2292             ((uint32_t *)src)[3];
2293     } else {
2294         src += (s->vga.sr[0x13] & 0x3f) * 256;
2295         src += (scr_y - s->vga.hw_cursor_y) * 4;
2296 
2297 
2298         poffset = 128;
2299         content = ((uint32_t *)src)[0] |
2300             ((uint32_t *)(src + 128))[0];
2301     }
2302     /* if nothing to draw, no need to continue */
2303     if (!content)
2304         return;
2305     w = h;
2306 
2307     x1 = s->vga.hw_cursor_x;
2308     if (x1 >= s->vga.last_scr_width)
2309         return;
2310     x2 = s->vga.hw_cursor_x + w;
2311     if (x2 > s->vga.last_scr_width)
2312         x2 = s->vga.last_scr_width;
2313     w = x2 - x1;
2314     palette = s->cirrus_hidden_palette;
2315     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2316                             c6_to_8(palette[0x0 * 3 + 1]),
2317                             c6_to_8(palette[0x0 * 3 + 2]));
2318     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2319                             c6_to_8(palette[0xf * 3 + 1]),
2320                             c6_to_8(palette[0xf * 3 + 2]));
2321     d1 += x1 * 4;
2322     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2323 }
2324 
2325 /***************************************
2326  *
2327  *  LFB memory access
2328  *
2329  ***************************************/
2330 
2331 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2332                                    unsigned size)
2333 {
2334     CirrusVGAState *s = opaque;
2335     uint32_t ret;
2336 
2337     addr &= s->cirrus_addr_mask;
2338 
2339     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2340         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2341 	/* memory-mapped I/O */
2342 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2343     } else if (0) {
2344 	/* XXX handle bitblt */
2345 	ret = 0xff;
2346     } else {
2347 	/* video memory */
2348 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2349 	    addr <<= 4;
2350 	} else if (s->vga.gr[0x0B] & 0x02) {
2351 	    addr <<= 3;
2352 	}
2353 	addr &= s->cirrus_addr_mask;
2354 	ret = *(s->vga.vram_ptr + addr);
2355     }
2356 
2357     return ret;
2358 }
2359 
2360 static void cirrus_linear_write(void *opaque, hwaddr addr,
2361                                 uint64_t val, unsigned size)
2362 {
2363     CirrusVGAState *s = opaque;
2364     unsigned mode;
2365 
2366     addr &= s->cirrus_addr_mask;
2367 
2368     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2369         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2370 	/* memory-mapped I/O */
2371 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2372     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2373 	/* bitblt */
2374 	*s->cirrus_srcptr++ = (uint8_t) val;
2375 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2376 	    cirrus_bitblt_cputovideo_next(s);
2377 	}
2378     } else {
2379 	/* video memory */
2380 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2381 	    addr <<= 4;
2382 	} else if (s->vga.gr[0x0B] & 0x02) {
2383 	    addr <<= 3;
2384 	}
2385 	addr &= s->cirrus_addr_mask;
2386 
2387 	mode = s->vga.gr[0x05] & 0x7;
2388 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2389 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2390             memory_region_set_dirty(&s->vga.vram, addr, 1);
2391 	} else {
2392 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2393 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2394 	    } else {
2395 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2396 	    }
2397 	}
2398     }
2399 }
2400 
2401 /***************************************
2402  *
2403  *  system to screen memory access
2404  *
2405  ***************************************/
2406 
2407 
2408 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2409                                           hwaddr addr,
2410                                           unsigned size)
2411 {
2412     CirrusVGAState *s = opaque;
2413     uint32_t ret;
2414 
2415     /* XXX handle bitblt */
2416     (void)s;
2417     ret = 0xff;
2418     return ret;
2419 }
2420 
2421 static void cirrus_linear_bitblt_write(void *opaque,
2422                                        hwaddr addr,
2423                                        uint64_t val,
2424                                        unsigned size)
2425 {
2426     CirrusVGAState *s = opaque;
2427 
2428     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2429 	/* bitblt */
2430 	*s->cirrus_srcptr++ = (uint8_t) val;
2431 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2432 	    cirrus_bitblt_cputovideo_next(s);
2433 	}
2434     }
2435 }
2436 
2437 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2438     .read = cirrus_linear_bitblt_read,
2439     .write = cirrus_linear_bitblt_write,
2440     .endianness = DEVICE_LITTLE_ENDIAN,
2441     .impl = {
2442         .min_access_size = 1,
2443         .max_access_size = 1,
2444     },
2445 };
2446 
2447 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2448 {
2449     MemoryRegion *mr = &s->cirrus_bank[bank];
2450     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2451         && !((s->vga.sr[0x07] & 0x01) == 0)
2452         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2453         && !(s->vga.gr[0x0B] & 0x02);
2454 
2455     memory_region_set_enabled(mr, enabled);
2456     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2457 }
2458 
2459 static void map_linear_vram(CirrusVGAState *s)
2460 {
2461     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2462         s->linear_vram = true;
2463         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2464     }
2465     map_linear_vram_bank(s, 0);
2466     map_linear_vram_bank(s, 1);
2467 }
2468 
2469 static void unmap_linear_vram(CirrusVGAState *s)
2470 {
2471     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2472         s->linear_vram = false;
2473         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2474     }
2475     memory_region_set_enabled(&s->cirrus_bank[0], false);
2476     memory_region_set_enabled(&s->cirrus_bank[1], false);
2477 }
2478 
2479 /* Compute the memory access functions */
2480 static void cirrus_update_memory_access(CirrusVGAState *s)
2481 {
2482     unsigned mode;
2483 
2484     memory_region_transaction_begin();
2485     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2486         goto generic_io;
2487     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2488         goto generic_io;
2489     } else {
2490 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2491             goto generic_io;
2492 	} else if (s->vga.gr[0x0B] & 0x02) {
2493             goto generic_io;
2494         }
2495 
2496 	mode = s->vga.gr[0x05] & 0x7;
2497 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2498             map_linear_vram(s);
2499         } else {
2500         generic_io:
2501             unmap_linear_vram(s);
2502         }
2503     }
2504     memory_region_transaction_commit();
2505 }
2506 
2507 
2508 /* I/O ports */
2509 
2510 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2511                                        unsigned size)
2512 {
2513     CirrusVGAState *c = opaque;
2514     VGACommonState *s = &c->vga;
2515     int val, index;
2516 
2517     addr += 0x3b0;
2518 
2519     if (vga_ioport_invalid(s, addr)) {
2520 	val = 0xff;
2521     } else {
2522 	switch (addr) {
2523 	case 0x3c0:
2524 	    if (s->ar_flip_flop == 0) {
2525 		val = s->ar_index;
2526 	    } else {
2527 		val = 0;
2528 	    }
2529 	    break;
2530 	case 0x3c1:
2531 	    index = s->ar_index & 0x1f;
2532 	    if (index < 21)
2533 		val = s->ar[index];
2534 	    else
2535 		val = 0;
2536 	    break;
2537 	case 0x3c2:
2538 	    val = s->st00;
2539 	    break;
2540 	case 0x3c4:
2541 	    val = s->sr_index;
2542 	    break;
2543 	case 0x3c5:
2544 	    val = cirrus_vga_read_sr(c);
2545             break;
2546 #ifdef DEBUG_VGA_REG
2547 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2548 #endif
2549 	    break;
2550 	case 0x3c6:
2551 	    val = cirrus_read_hidden_dac(c);
2552 	    break;
2553 	case 0x3c7:
2554 	    val = s->dac_state;
2555 	    break;
2556 	case 0x3c8:
2557 	    val = s->dac_write_index;
2558 	    c->cirrus_hidden_dac_lockindex = 0;
2559 	    break;
2560         case 0x3c9:
2561             val = cirrus_vga_read_palette(c);
2562             break;
2563 	case 0x3ca:
2564 	    val = s->fcr;
2565 	    break;
2566 	case 0x3cc:
2567 	    val = s->msr;
2568 	    break;
2569 	case 0x3ce:
2570 	    val = s->gr_index;
2571 	    break;
2572 	case 0x3cf:
2573 	    val = cirrus_vga_read_gr(c, s->gr_index);
2574 #ifdef DEBUG_VGA_REG
2575 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2576 #endif
2577 	    break;
2578 	case 0x3b4:
2579 	case 0x3d4:
2580 	    val = s->cr_index;
2581 	    break;
2582 	case 0x3b5:
2583 	case 0x3d5:
2584             val = cirrus_vga_read_cr(c, s->cr_index);
2585 #ifdef DEBUG_VGA_REG
2586 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2587 #endif
2588 	    break;
2589 	case 0x3ba:
2590 	case 0x3da:
2591 	    /* just toggle to fool polling */
2592 	    val = s->st01 = s->retrace(s);
2593 	    s->ar_flip_flop = 0;
2594 	    break;
2595 	default:
2596 	    val = 0x00;
2597 	    break;
2598 	}
2599     }
2600     trace_vga_cirrus_read_io(addr, val);
2601     return val;
2602 }
2603 
2604 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2605                                     unsigned size)
2606 {
2607     CirrusVGAState *c = opaque;
2608     VGACommonState *s = &c->vga;
2609     int index;
2610 
2611     addr += 0x3b0;
2612 
2613     /* check port range access depending on color/monochrome mode */
2614     if (vga_ioport_invalid(s, addr)) {
2615 	return;
2616     }
2617     trace_vga_cirrus_write_io(addr, val);
2618 
2619     switch (addr) {
2620     case 0x3c0:
2621 	if (s->ar_flip_flop == 0) {
2622 	    val &= 0x3f;
2623 	    s->ar_index = val;
2624 	} else {
2625 	    index = s->ar_index & 0x1f;
2626 	    switch (index) {
2627 	    case 0x00 ... 0x0f:
2628 		s->ar[index] = val & 0x3f;
2629 		break;
2630 	    case 0x10:
2631 		s->ar[index] = val & ~0x10;
2632 		break;
2633 	    case 0x11:
2634 		s->ar[index] = val;
2635 		break;
2636 	    case 0x12:
2637 		s->ar[index] = val & ~0xc0;
2638 		break;
2639 	    case 0x13:
2640 		s->ar[index] = val & ~0xf0;
2641 		break;
2642 	    case 0x14:
2643 		s->ar[index] = val & ~0xf0;
2644 		break;
2645 	    default:
2646 		break;
2647 	    }
2648 	}
2649 	s->ar_flip_flop ^= 1;
2650 	break;
2651     case 0x3c2:
2652 	s->msr = val & ~0x10;
2653 	s->update_retrace_info(s);
2654 	break;
2655     case 0x3c4:
2656 	s->sr_index = val;
2657 	break;
2658     case 0x3c5:
2659 #ifdef DEBUG_VGA_REG
2660 	printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2661 #endif
2662 	cirrus_vga_write_sr(c, val);
2663         break;
2664     case 0x3c6:
2665 	cirrus_write_hidden_dac(c, val);
2666 	break;
2667     case 0x3c7:
2668 	s->dac_read_index = val;
2669 	s->dac_sub_index = 0;
2670 	s->dac_state = 3;
2671 	break;
2672     case 0x3c8:
2673 	s->dac_write_index = val;
2674 	s->dac_sub_index = 0;
2675 	s->dac_state = 0;
2676 	break;
2677     case 0x3c9:
2678         cirrus_vga_write_palette(c, val);
2679         break;
2680     case 0x3ce:
2681 	s->gr_index = val;
2682 	break;
2683     case 0x3cf:
2684 #ifdef DEBUG_VGA_REG
2685 	printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2686 #endif
2687 	cirrus_vga_write_gr(c, s->gr_index, val);
2688 	break;
2689     case 0x3b4:
2690     case 0x3d4:
2691 	s->cr_index = val;
2692 	break;
2693     case 0x3b5:
2694     case 0x3d5:
2695 #ifdef DEBUG_VGA_REG
2696 	printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2697 #endif
2698 	cirrus_vga_write_cr(c, val);
2699 	break;
2700     case 0x3ba:
2701     case 0x3da:
2702 	s->fcr = val & 0x10;
2703 	break;
2704     }
2705 }
2706 
2707 /***************************************
2708  *
2709  *  memory-mapped I/O access
2710  *
2711  ***************************************/
2712 
2713 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2714                                  unsigned size)
2715 {
2716     CirrusVGAState *s = opaque;
2717 
2718     if (addr >= 0x100) {
2719         return cirrus_mmio_blt_read(s, addr - 0x100);
2720     } else {
2721         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2722     }
2723 }
2724 
2725 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2726                               uint64_t val, unsigned size)
2727 {
2728     CirrusVGAState *s = opaque;
2729 
2730     if (addr >= 0x100) {
2731 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2732     } else {
2733         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2734     }
2735 }
2736 
2737 static const MemoryRegionOps cirrus_mmio_io_ops = {
2738     .read = cirrus_mmio_read,
2739     .write = cirrus_mmio_write,
2740     .endianness = DEVICE_LITTLE_ENDIAN,
2741     .impl = {
2742         .min_access_size = 1,
2743         .max_access_size = 1,
2744     },
2745 };
2746 
2747 /* load/save state */
2748 
2749 static int cirrus_post_load(void *opaque, int version_id)
2750 {
2751     CirrusVGAState *s = opaque;
2752 
2753     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2754     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2755 
2756     cirrus_update_bank_ptr(s, 0);
2757     cirrus_update_bank_ptr(s, 1);
2758     cirrus_update_memory_access(s);
2759     /* force refresh */
2760     s->vga.graphic_mode = -1;
2761 
2762     return 0;
2763 }
2764 
2765 const VMStateDescription vmstate_cirrus_vga = {
2766     .name = "cirrus_vga",
2767     .version_id = 2,
2768     .minimum_version_id = 1,
2769     .post_load = cirrus_post_load,
2770     .fields = (VMStateField[]) {
2771         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2772         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2773         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2774         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2775         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2776         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2777         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2778         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2779         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2780         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2781         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2782         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2783         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2784         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2785         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2786         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2787         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2788         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2789         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2790         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2791         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2792         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2793         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2794         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2795         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2796         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2797         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2798         /* XXX: we do not save the bitblt state - we assume we do not save
2799            the state when the blitter is active */
2800         VMSTATE_END_OF_LIST()
2801     }
2802 };
2803 
2804 static const VMStateDescription vmstate_pci_cirrus_vga = {
2805     .name = "cirrus_vga",
2806     .version_id = 2,
2807     .minimum_version_id = 2,
2808     .fields = (VMStateField[]) {
2809         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2810         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2811                        vmstate_cirrus_vga, CirrusVGAState),
2812         VMSTATE_END_OF_LIST()
2813     }
2814 };
2815 
2816 /***************************************
2817  *
2818  *  initialize
2819  *
2820  ***************************************/
2821 
2822 static void cirrus_reset(void *opaque)
2823 {
2824     CirrusVGAState *s = opaque;
2825 
2826     vga_common_reset(&s->vga);
2827     unmap_linear_vram(s);
2828     s->vga.sr[0x06] = 0x0f;
2829     if (s->device_id == CIRRUS_ID_CLGD5446) {
2830         /* 4MB 64 bit memory config, always PCI */
2831         s->vga.sr[0x1F] = 0x2d;		// MemClock
2832         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2833         s->vga.sr[0x0f] = 0x98;
2834         s->vga.sr[0x17] = 0x20;
2835         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2836     } else {
2837         s->vga.sr[0x1F] = 0x22;		// MemClock
2838         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2839         s->vga.sr[0x17] = s->bustype;
2840         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2841     }
2842     s->vga.cr[0x27] = s->device_id;
2843 
2844     s->cirrus_hidden_dac_lockindex = 5;
2845     s->cirrus_hidden_dac_data = 0;
2846 }
2847 
2848 static const MemoryRegionOps cirrus_linear_io_ops = {
2849     .read = cirrus_linear_read,
2850     .write = cirrus_linear_write,
2851     .endianness = DEVICE_LITTLE_ENDIAN,
2852     .impl = {
2853         .min_access_size = 1,
2854         .max_access_size = 1,
2855     },
2856 };
2857 
2858 static const MemoryRegionOps cirrus_vga_io_ops = {
2859     .read = cirrus_vga_ioport_read,
2860     .write = cirrus_vga_ioport_write,
2861     .endianness = DEVICE_LITTLE_ENDIAN,
2862     .impl = {
2863         .min_access_size = 1,
2864         .max_access_size = 1,
2865     },
2866 };
2867 
2868 void cirrus_init_common(CirrusVGAState *s, Object *owner,
2869                         int device_id, int is_pci,
2870                         MemoryRegion *system_memory, MemoryRegion *system_io)
2871 {
2872     int i;
2873     static int inited;
2874 
2875     if (!inited) {
2876         inited = 1;
2877         for(i = 0;i < 256; i++)
2878             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2879         rop_to_index[CIRRUS_ROP_0] = 0;
2880         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2881         rop_to_index[CIRRUS_ROP_NOP] = 2;
2882         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2883         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2884         rop_to_index[CIRRUS_ROP_SRC] = 5;
2885         rop_to_index[CIRRUS_ROP_1] = 6;
2886         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2887         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2888         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2889         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2890         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2891         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2892         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2893         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2894         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2895         s->device_id = device_id;
2896         if (is_pci)
2897             s->bustype = CIRRUS_BUSTYPE_PCI;
2898         else
2899             s->bustype = CIRRUS_BUSTYPE_ISA;
2900     }
2901 
2902     /* Register ioport 0x3b0 - 0x3df */
2903     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2904                           "cirrus-io", 0x30);
2905     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2906     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2907 
2908     memory_region_init(&s->low_mem_container, owner,
2909                        "cirrus-lowmem-container",
2910                        0x20000);
2911 
2912     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2913                           "cirrus-low-memory", 0x20000);
2914     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2915     for (i = 0; i < 2; ++i) {
2916         static const char *names[] = { "vga.bank0", "vga.bank1" };
2917         MemoryRegion *bank = &s->cirrus_bank[i];
2918         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2919                                  0, 0x8000);
2920         memory_region_set_enabled(bank, false);
2921         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2922                                             bank, 1);
2923     }
2924     memory_region_add_subregion_overlap(system_memory,
2925                                         0x000a0000,
2926                                         &s->low_mem_container,
2927                                         1);
2928     memory_region_set_coalescing(&s->low_mem);
2929 
2930     /* I/O handler for LFB */
2931     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2932                           "cirrus-linear-io", s->vga.vram_size_mb * MiB);
2933     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2934 
2935     /* I/O handler for LFB */
2936     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2937                           &cirrus_linear_bitblt_io_ops,
2938                           s,
2939                           "cirrus-bitblt-mmio",
2940                           0x400000);
2941     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2942 
2943     /* I/O handler for memory-mapped I/O */
2944     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2945                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2946     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2947 
2948     s->real_vram_size =
2949         (s->device_id == CIRRUS_ID_CLGD5446) ? 4 * MiB : 2 * MiB;
2950 
2951     /* XXX: s->vga.vram_size must be a power of two */
2952     s->cirrus_addr_mask = s->real_vram_size - 1;
2953     s->linear_mmio_mask = s->real_vram_size - 256;
2954 
2955     s->vga.get_bpp = cirrus_get_bpp;
2956     s->vga.get_offsets = cirrus_get_offsets;
2957     s->vga.get_resolution = cirrus_get_resolution;
2958     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2959     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2960 
2961     qemu_register_reset(cirrus_reset, s);
2962 }
2963 
2964 /***************************************
2965  *
2966  *  PCI bus support
2967  *
2968  ***************************************/
2969 
2970 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
2971 {
2972      PCICirrusVGAState *d = PCI_CIRRUS_VGA(dev);
2973      CirrusVGAState *s = &d->cirrus_vga;
2974      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
2975      int16_t device_id = pc->device_id;
2976 
2977      /* follow real hardware, cirrus card emulated has 4 MB video memory.
2978        Also accept 8 MB/16 MB for backward compatibility. */
2979      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
2980          s->vga.vram_size_mb != 16) {
2981          error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2982                     s->vga.vram_size_mb);
2983          return;
2984      }
2985      /* setup VGA */
2986      vga_common_init(&s->vga, OBJECT(dev));
2987      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
2988                         pci_address_space_io(dev));
2989      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
2990 
2991      /* setup PCI */
2992 
2993     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
2994 
2995     /* XXX: add byte swapping apertures */
2996     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
2997     memory_region_add_subregion(&s->pci_bar, 0x1000000,
2998                                 &s->cirrus_linear_bitblt_io);
2999 
3000      /* setup memory space */
3001      /* memory #0 LFB */
3002      /* memory #1 memory-mapped I/O */
3003      /* XXX: s->vga.vram_size must be a power of two */
3004      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
3005      if (device_id == CIRRUS_ID_CLGD5446) {
3006          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
3007      }
3008 }
3009 
3010 static Property pci_vga_cirrus_properties[] = {
3011     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
3012                        cirrus_vga.vga.vram_size_mb, 4),
3013     DEFINE_PROP_BOOL("blitter", struct PCICirrusVGAState,
3014                      cirrus_vga.enable_blitter, true),
3015     DEFINE_PROP_BOOL("global-vmstate", struct PCICirrusVGAState,
3016                      cirrus_vga.vga.global_vmstate, false),
3017     DEFINE_PROP_END_OF_LIST(),
3018 };
3019 
3020 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3021 {
3022     DeviceClass *dc = DEVICE_CLASS(klass);
3023     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3024 
3025     k->realize = pci_cirrus_vga_realize;
3026     k->romfile = VGABIOS_CIRRUS_FILENAME;
3027     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3028     k->device_id = CIRRUS_ID_CLGD5446;
3029     k->class_id = PCI_CLASS_DISPLAY_VGA;
3030     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3031     dc->desc = "Cirrus CLGD 54xx VGA";
3032     dc->vmsd = &vmstate_pci_cirrus_vga;
3033     dc->props = pci_vga_cirrus_properties;
3034     dc->hotpluggable = false;
3035 }
3036 
3037 static const TypeInfo cirrus_vga_info = {
3038     .name          = TYPE_PCI_CIRRUS_VGA,
3039     .parent        = TYPE_PCI_DEVICE,
3040     .instance_size = sizeof(PCICirrusVGAState),
3041     .class_init    = cirrus_vga_class_init,
3042     .interfaces = (InterfaceInfo[]) {
3043         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
3044         { },
3045     },
3046 };
3047 
3048 static void cirrus_vga_register_types(void)
3049 {
3050     type_register_static(&cirrus_vga_info);
3051 }
3052 
3053 type_init(cirrus_vga_register_types)
3054