xref: /openbmc/qemu/hw/display/sm501.c (revision 65a117da)
1 /*
2  * QEMU SM501 Device
3  *
4  * Copyright (c) 2008 Shin-ichiro KAWASAKI
5  * Copyright (c) 2016-2020 BALATON Zoltan
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "qemu/units.h"
28 #include "qapi/error.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "hw/char/serial.h"
32 #include "ui/console.h"
33 #include "hw/sysbus.h"
34 #include "migration/vmstate.h"
35 #include "hw/pci/pci.h"
36 #include "hw/qdev-properties.h"
37 #include "hw/i2c/i2c.h"
38 #include "hw/display/i2c-ddc.h"
39 #include "qemu/range.h"
40 #include "ui/pixel_ops.h"
41 #include "qemu/bswap.h"
42 
43 /*#define DEBUG_SM501*/
44 /*#define DEBUG_BITBLT*/
45 
46 #ifdef DEBUG_SM501
47 #define SM501_DPRINTF(fmt, ...) printf(fmt, ## __VA_ARGS__)
48 #else
49 #define SM501_DPRINTF(fmt, ...) do {} while (0)
50 #endif
51 
52 #define MMIO_BASE_OFFSET 0x3e00000
53 #define MMIO_SIZE 0x200000
54 #define DC_PALETTE_ENTRIES (0x400 * 3)
55 
56 /* SM501 register definitions taken from "linux/include/linux/sm501-regs.h" */
57 
58 /* System Configuration area */
59 /* System config base */
60 #define SM501_SYS_CONFIG                (0x000000)
61 
62 /* config 1 */
63 #define SM501_SYSTEM_CONTROL            (0x000000)
64 
65 #define SM501_SYSCTRL_PANEL_TRISTATE    (1 << 0)
66 #define SM501_SYSCTRL_MEM_TRISTATE      (1 << 1)
67 #define SM501_SYSCTRL_CRT_TRISTATE      (1 << 2)
68 
69 #define SM501_SYSCTRL_PCI_SLAVE_BURST_MASK (3 << 4)
70 #define SM501_SYSCTRL_PCI_SLAVE_BURST_1 (0 << 4)
71 #define SM501_SYSCTRL_PCI_SLAVE_BURST_2 (1 << 4)
72 #define SM501_SYSCTRL_PCI_SLAVE_BURST_4 (2 << 4)
73 #define SM501_SYSCTRL_PCI_SLAVE_BURST_8 (3 << 4)
74 
75 #define SM501_SYSCTRL_PCI_CLOCK_RUN_EN  (1 << 6)
76 #define SM501_SYSCTRL_PCI_RETRY_DISABLE (1 << 7)
77 #define SM501_SYSCTRL_PCI_SUBSYS_LOCK   (1 << 11)
78 #define SM501_SYSCTRL_PCI_BURST_READ_EN (1 << 15)
79 
80 /* miscellaneous control */
81 
82 #define SM501_MISC_CONTROL              (0x000004)
83 
84 #define SM501_MISC_BUS_SH               (0x0)
85 #define SM501_MISC_BUS_PCI              (0x1)
86 #define SM501_MISC_BUS_XSCALE           (0x2)
87 #define SM501_MISC_BUS_NEC              (0x6)
88 #define SM501_MISC_BUS_MASK             (0x7)
89 
90 #define SM501_MISC_VR_62MB              (1 << 3)
91 #define SM501_MISC_CDR_RESET            (1 << 7)
92 #define SM501_MISC_USB_LB               (1 << 8)
93 #define SM501_MISC_USB_SLAVE            (1 << 9)
94 #define SM501_MISC_BL_1                 (1 << 10)
95 #define SM501_MISC_MC                   (1 << 11)
96 #define SM501_MISC_DAC_POWER            (1 << 12)
97 #define SM501_MISC_IRQ_INVERT           (1 << 16)
98 #define SM501_MISC_SH                   (1 << 17)
99 
100 #define SM501_MISC_HOLD_EMPTY           (0 << 18)
101 #define SM501_MISC_HOLD_8               (1 << 18)
102 #define SM501_MISC_HOLD_16              (2 << 18)
103 #define SM501_MISC_HOLD_24              (3 << 18)
104 #define SM501_MISC_HOLD_32              (4 << 18)
105 #define SM501_MISC_HOLD_MASK            (7 << 18)
106 
107 #define SM501_MISC_FREQ_12              (1 << 24)
108 #define SM501_MISC_PNL_24BIT            (1 << 25)
109 #define SM501_MISC_8051_LE              (1 << 26)
110 
111 
112 
113 #define SM501_GPIO31_0_CONTROL          (0x000008)
114 #define SM501_GPIO63_32_CONTROL         (0x00000C)
115 #define SM501_DRAM_CONTROL              (0x000010)
116 
117 /* command list */
118 #define SM501_ARBTRTN_CONTROL           (0x000014)
119 
120 /* command list */
121 #define SM501_COMMAND_LIST_STATUS       (0x000024)
122 
123 /* interrupt debug */
124 #define SM501_RAW_IRQ_STATUS            (0x000028)
125 #define SM501_RAW_IRQ_CLEAR             (0x000028)
126 #define SM501_IRQ_STATUS                (0x00002C)
127 #define SM501_IRQ_MASK                  (0x000030)
128 #define SM501_DEBUG_CONTROL             (0x000034)
129 
130 /* power management */
131 #define SM501_POWERMODE_P2X_SRC         (1 << 29)
132 #define SM501_POWERMODE_V2X_SRC         (1 << 20)
133 #define SM501_POWERMODE_M_SRC           (1 << 12)
134 #define SM501_POWERMODE_M1_SRC          (1 << 4)
135 
136 #define SM501_CURRENT_GATE              (0x000038)
137 #define SM501_CURRENT_CLOCK             (0x00003C)
138 #define SM501_POWER_MODE_0_GATE         (0x000040)
139 #define SM501_POWER_MODE_0_CLOCK        (0x000044)
140 #define SM501_POWER_MODE_1_GATE         (0x000048)
141 #define SM501_POWER_MODE_1_CLOCK        (0x00004C)
142 #define SM501_SLEEP_MODE_GATE           (0x000050)
143 #define SM501_POWER_MODE_CONTROL        (0x000054)
144 
145 /* power gates for units within the 501 */
146 #define SM501_GATE_HOST                 (0)
147 #define SM501_GATE_MEMORY               (1)
148 #define SM501_GATE_DISPLAY              (2)
149 #define SM501_GATE_2D_ENGINE            (3)
150 #define SM501_GATE_CSC                  (4)
151 #define SM501_GATE_ZVPORT               (5)
152 #define SM501_GATE_GPIO                 (6)
153 #define SM501_GATE_UART0                (7)
154 #define SM501_GATE_UART1                (8)
155 #define SM501_GATE_SSP                  (10)
156 #define SM501_GATE_USB_HOST             (11)
157 #define SM501_GATE_USB_GADGET           (12)
158 #define SM501_GATE_UCONTROLLER          (17)
159 #define SM501_GATE_AC97                 (18)
160 
161 /* panel clock */
162 #define SM501_CLOCK_P2XCLK              (24)
163 /* crt clock */
164 #define SM501_CLOCK_V2XCLK              (16)
165 /* main clock */
166 #define SM501_CLOCK_MCLK                (8)
167 /* SDRAM controller clock */
168 #define SM501_CLOCK_M1XCLK              (0)
169 
170 /* config 2 */
171 #define SM501_PCI_MASTER_BASE           (0x000058)
172 #define SM501_ENDIAN_CONTROL            (0x00005C)
173 #define SM501_DEVICEID                  (0x000060)
174 /* 0x050100A0 */
175 
176 #define SM501_DEVICEID_SM501            (0x05010000)
177 #define SM501_DEVICEID_IDMASK           (0xffff0000)
178 #define SM501_DEVICEID_REVMASK          (0x000000ff)
179 
180 #define SM501_PLLCLOCK_COUNT            (0x000064)
181 #define SM501_MISC_TIMING               (0x000068)
182 #define SM501_CURRENT_SDRAM_CLOCK       (0x00006C)
183 
184 #define SM501_PROGRAMMABLE_PLL_CONTROL  (0x000074)
185 
186 /* GPIO base */
187 #define SM501_GPIO                      (0x010000)
188 #define SM501_GPIO_DATA_LOW             (0x00)
189 #define SM501_GPIO_DATA_HIGH            (0x04)
190 #define SM501_GPIO_DDR_LOW              (0x08)
191 #define SM501_GPIO_DDR_HIGH             (0x0C)
192 #define SM501_GPIO_IRQ_SETUP            (0x10)
193 #define SM501_GPIO_IRQ_STATUS           (0x14)
194 #define SM501_GPIO_IRQ_RESET            (0x14)
195 
196 /* I2C controller base */
197 #define SM501_I2C                       (0x010040)
198 #define SM501_I2C_BYTE_COUNT            (0x00)
199 #define SM501_I2C_CONTROL               (0x01)
200 #define SM501_I2C_STATUS                (0x02)
201 #define SM501_I2C_RESET                 (0x02)
202 #define SM501_I2C_SLAVE_ADDRESS         (0x03)
203 #define SM501_I2C_DATA                  (0x04)
204 
205 #define SM501_I2C_CONTROL_START         (1 << 2)
206 #define SM501_I2C_CONTROL_ENABLE        (1 << 0)
207 
208 #define SM501_I2C_STATUS_COMPLETE       (1 << 3)
209 #define SM501_I2C_STATUS_ERROR          (1 << 2)
210 
211 #define SM501_I2C_RESET_ERROR           (1 << 2)
212 
213 /* SSP base */
214 #define SM501_SSP                       (0x020000)
215 
216 /* Uart 0 base */
217 #define SM501_UART0                     (0x030000)
218 
219 /* Uart 1 base */
220 #define SM501_UART1                     (0x030020)
221 
222 /* USB host port base */
223 #define SM501_USB_HOST                  (0x040000)
224 
225 /* USB slave/gadget base */
226 #define SM501_USB_GADGET                (0x060000)
227 
228 /* USB slave/gadget data port base */
229 #define SM501_USB_GADGET_DATA           (0x070000)
230 
231 /* Display controller/video engine base */
232 #define SM501_DC                        (0x080000)
233 
234 /* common defines for the SM501 address registers */
235 #define SM501_ADDR_FLIP                 (1 << 31)
236 #define SM501_ADDR_EXT                  (1 << 27)
237 #define SM501_ADDR_CS1                  (1 << 26)
238 #define SM501_ADDR_MASK                 (0x3f << 26)
239 
240 #define SM501_FIFO_MASK                 (0x3 << 16)
241 #define SM501_FIFO_1                    (0x0 << 16)
242 #define SM501_FIFO_3                    (0x1 << 16)
243 #define SM501_FIFO_7                    (0x2 << 16)
244 #define SM501_FIFO_11                   (0x3 << 16)
245 
246 /* common registers for panel and the crt */
247 #define SM501_OFF_DC_H_TOT              (0x000)
248 #define SM501_OFF_DC_V_TOT              (0x008)
249 #define SM501_OFF_DC_H_SYNC             (0x004)
250 #define SM501_OFF_DC_V_SYNC             (0x00C)
251 
252 #define SM501_DC_PANEL_CONTROL          (0x000)
253 
254 #define SM501_DC_PANEL_CONTROL_FPEN     (1 << 27)
255 #define SM501_DC_PANEL_CONTROL_BIAS     (1 << 26)
256 #define SM501_DC_PANEL_CONTROL_DATA     (1 << 25)
257 #define SM501_DC_PANEL_CONTROL_VDD      (1 << 24)
258 #define SM501_DC_PANEL_CONTROL_DP       (1 << 23)
259 
260 #define SM501_DC_PANEL_CONTROL_TFT_888  (0 << 21)
261 #define SM501_DC_PANEL_CONTROL_TFT_333  (1 << 21)
262 #define SM501_DC_PANEL_CONTROL_TFT_444  (2 << 21)
263 
264 #define SM501_DC_PANEL_CONTROL_DE       (1 << 20)
265 
266 #define SM501_DC_PANEL_CONTROL_LCD_TFT  (0 << 18)
267 #define SM501_DC_PANEL_CONTROL_LCD_STN8 (1 << 18)
268 #define SM501_DC_PANEL_CONTROL_LCD_STN12 (2 << 18)
269 
270 #define SM501_DC_PANEL_CONTROL_CP       (1 << 14)
271 #define SM501_DC_PANEL_CONTROL_VSP      (1 << 13)
272 #define SM501_DC_PANEL_CONTROL_HSP      (1 << 12)
273 #define SM501_DC_PANEL_CONTROL_CK       (1 << 9)
274 #define SM501_DC_PANEL_CONTROL_TE       (1 << 8)
275 #define SM501_DC_PANEL_CONTROL_VPD      (1 << 7)
276 #define SM501_DC_PANEL_CONTROL_VP       (1 << 6)
277 #define SM501_DC_PANEL_CONTROL_HPD      (1 << 5)
278 #define SM501_DC_PANEL_CONTROL_HP       (1 << 4)
279 #define SM501_DC_PANEL_CONTROL_GAMMA    (1 << 3)
280 #define SM501_DC_PANEL_CONTROL_EN       (1 << 2)
281 
282 #define SM501_DC_PANEL_CONTROL_8BPP     (0 << 0)
283 #define SM501_DC_PANEL_CONTROL_16BPP    (1 << 0)
284 #define SM501_DC_PANEL_CONTROL_32BPP    (2 << 0)
285 
286 
287 #define SM501_DC_PANEL_PANNING_CONTROL  (0x004)
288 #define SM501_DC_PANEL_COLOR_KEY        (0x008)
289 #define SM501_DC_PANEL_FB_ADDR          (0x00C)
290 #define SM501_DC_PANEL_FB_OFFSET        (0x010)
291 #define SM501_DC_PANEL_FB_WIDTH         (0x014)
292 #define SM501_DC_PANEL_FB_HEIGHT        (0x018)
293 #define SM501_DC_PANEL_TL_LOC           (0x01C)
294 #define SM501_DC_PANEL_BR_LOC           (0x020)
295 #define SM501_DC_PANEL_H_TOT            (0x024)
296 #define SM501_DC_PANEL_H_SYNC           (0x028)
297 #define SM501_DC_PANEL_V_TOT            (0x02C)
298 #define SM501_DC_PANEL_V_SYNC           (0x030)
299 #define SM501_DC_PANEL_CUR_LINE         (0x034)
300 
301 #define SM501_DC_VIDEO_CONTROL          (0x040)
302 #define SM501_DC_VIDEO_FB0_ADDR         (0x044)
303 #define SM501_DC_VIDEO_FB_WIDTH         (0x048)
304 #define SM501_DC_VIDEO_FB0_LAST_ADDR    (0x04C)
305 #define SM501_DC_VIDEO_TL_LOC           (0x050)
306 #define SM501_DC_VIDEO_BR_LOC           (0x054)
307 #define SM501_DC_VIDEO_SCALE            (0x058)
308 #define SM501_DC_VIDEO_INIT_SCALE       (0x05C)
309 #define SM501_DC_VIDEO_YUV_CONSTANTS    (0x060)
310 #define SM501_DC_VIDEO_FB1_ADDR         (0x064)
311 #define SM501_DC_VIDEO_FB1_LAST_ADDR    (0x068)
312 
313 #define SM501_DC_VIDEO_ALPHA_CONTROL    (0x080)
314 #define SM501_DC_VIDEO_ALPHA_FB_ADDR    (0x084)
315 #define SM501_DC_VIDEO_ALPHA_FB_OFFSET  (0x088)
316 #define SM501_DC_VIDEO_ALPHA_FB_LAST_ADDR (0x08C)
317 #define SM501_DC_VIDEO_ALPHA_TL_LOC     (0x090)
318 #define SM501_DC_VIDEO_ALPHA_BR_LOC     (0x094)
319 #define SM501_DC_VIDEO_ALPHA_SCALE      (0x098)
320 #define SM501_DC_VIDEO_ALPHA_INIT_SCALE (0x09C)
321 #define SM501_DC_VIDEO_ALPHA_CHROMA_KEY (0x0A0)
322 #define SM501_DC_VIDEO_ALPHA_COLOR_LOOKUP (0x0A4)
323 
324 #define SM501_DC_PANEL_HWC_BASE         (0x0F0)
325 #define SM501_DC_PANEL_HWC_ADDR         (0x0F0)
326 #define SM501_DC_PANEL_HWC_LOC          (0x0F4)
327 #define SM501_DC_PANEL_HWC_COLOR_1_2    (0x0F8)
328 #define SM501_DC_PANEL_HWC_COLOR_3      (0x0FC)
329 
330 #define SM501_HWC_EN                    (1 << 31)
331 
332 #define SM501_OFF_HWC_ADDR              (0x00)
333 #define SM501_OFF_HWC_LOC               (0x04)
334 #define SM501_OFF_HWC_COLOR_1_2         (0x08)
335 #define SM501_OFF_HWC_COLOR_3           (0x0C)
336 
337 #define SM501_DC_ALPHA_CONTROL          (0x100)
338 #define SM501_DC_ALPHA_FB_ADDR          (0x104)
339 #define SM501_DC_ALPHA_FB_OFFSET        (0x108)
340 #define SM501_DC_ALPHA_TL_LOC           (0x10C)
341 #define SM501_DC_ALPHA_BR_LOC           (0x110)
342 #define SM501_DC_ALPHA_CHROMA_KEY       (0x114)
343 #define SM501_DC_ALPHA_COLOR_LOOKUP     (0x118)
344 
345 #define SM501_DC_CRT_CONTROL            (0x200)
346 
347 #define SM501_DC_CRT_CONTROL_TVP        (1 << 15)
348 #define SM501_DC_CRT_CONTROL_CP         (1 << 14)
349 #define SM501_DC_CRT_CONTROL_VSP        (1 << 13)
350 #define SM501_DC_CRT_CONTROL_HSP        (1 << 12)
351 #define SM501_DC_CRT_CONTROL_VS         (1 << 11)
352 #define SM501_DC_CRT_CONTROL_BLANK      (1 << 10)
353 #define SM501_DC_CRT_CONTROL_SEL        (1 << 9)
354 #define SM501_DC_CRT_CONTROL_TE         (1 << 8)
355 #define SM501_DC_CRT_CONTROL_PIXEL_MASK (0xF << 4)
356 #define SM501_DC_CRT_CONTROL_GAMMA      (1 << 3)
357 #define SM501_DC_CRT_CONTROL_ENABLE     (1 << 2)
358 
359 #define SM501_DC_CRT_CONTROL_8BPP       (0 << 0)
360 #define SM501_DC_CRT_CONTROL_16BPP      (1 << 0)
361 #define SM501_DC_CRT_CONTROL_32BPP      (2 << 0)
362 
363 #define SM501_DC_CRT_FB_ADDR            (0x204)
364 #define SM501_DC_CRT_FB_OFFSET          (0x208)
365 #define SM501_DC_CRT_H_TOT              (0x20C)
366 #define SM501_DC_CRT_H_SYNC             (0x210)
367 #define SM501_DC_CRT_V_TOT              (0x214)
368 #define SM501_DC_CRT_V_SYNC             (0x218)
369 #define SM501_DC_CRT_SIGNATURE_ANALYZER (0x21C)
370 #define SM501_DC_CRT_CUR_LINE           (0x220)
371 #define SM501_DC_CRT_MONITOR_DETECT     (0x224)
372 
373 #define SM501_DC_CRT_HWC_BASE           (0x230)
374 #define SM501_DC_CRT_HWC_ADDR           (0x230)
375 #define SM501_DC_CRT_HWC_LOC            (0x234)
376 #define SM501_DC_CRT_HWC_COLOR_1_2      (0x238)
377 #define SM501_DC_CRT_HWC_COLOR_3        (0x23C)
378 
379 #define SM501_DC_PANEL_PALETTE          (0x400)
380 
381 #define SM501_DC_VIDEO_PALETTE          (0x800)
382 
383 #define SM501_DC_CRT_PALETTE            (0xC00)
384 
385 /* Zoom Video port base */
386 #define SM501_ZVPORT                    (0x090000)
387 
388 /* AC97/I2S base */
389 #define SM501_AC97                      (0x0A0000)
390 
391 /* 8051 micro controller base */
392 #define SM501_UCONTROLLER               (0x0B0000)
393 
394 /* 8051 micro controller SRAM base */
395 #define SM501_UCONTROLLER_SRAM          (0x0C0000)
396 
397 /* DMA base */
398 #define SM501_DMA                       (0x0D0000)
399 
400 /* 2d engine base */
401 #define SM501_2D_ENGINE                 (0x100000)
402 #define SM501_2D_SOURCE                 (0x00)
403 #define SM501_2D_DESTINATION            (0x04)
404 #define SM501_2D_DIMENSION              (0x08)
405 #define SM501_2D_CONTROL                (0x0C)
406 #define SM501_2D_PITCH                  (0x10)
407 #define SM501_2D_FOREGROUND             (0x14)
408 #define SM501_2D_BACKGROUND             (0x18)
409 #define SM501_2D_STRETCH                (0x1C)
410 #define SM501_2D_COLOR_COMPARE          (0x20)
411 #define SM501_2D_COLOR_COMPARE_MASK     (0x24)
412 #define SM501_2D_MASK                   (0x28)
413 #define SM501_2D_CLIP_TL                (0x2C)
414 #define SM501_2D_CLIP_BR                (0x30)
415 #define SM501_2D_MONO_PATTERN_LOW       (0x34)
416 #define SM501_2D_MONO_PATTERN_HIGH      (0x38)
417 #define SM501_2D_WINDOW_WIDTH           (0x3C)
418 #define SM501_2D_SOURCE_BASE            (0x40)
419 #define SM501_2D_DESTINATION_BASE       (0x44)
420 #define SM501_2D_ALPHA                  (0x48)
421 #define SM501_2D_WRAP                   (0x4C)
422 #define SM501_2D_STATUS                 (0x50)
423 
424 #define SM501_CSC_Y_SOURCE_BASE         (0xC8)
425 #define SM501_CSC_CONSTANTS             (0xCC)
426 #define SM501_CSC_Y_SOURCE_X            (0xD0)
427 #define SM501_CSC_Y_SOURCE_Y            (0xD4)
428 #define SM501_CSC_U_SOURCE_BASE         (0xD8)
429 #define SM501_CSC_V_SOURCE_BASE         (0xDC)
430 #define SM501_CSC_SOURCE_DIMENSION      (0xE0)
431 #define SM501_CSC_SOURCE_PITCH          (0xE4)
432 #define SM501_CSC_DESTINATION           (0xE8)
433 #define SM501_CSC_DESTINATION_DIMENSION (0xEC)
434 #define SM501_CSC_DESTINATION_PITCH     (0xF0)
435 #define SM501_CSC_SCALE_FACTOR          (0xF4)
436 #define SM501_CSC_DESTINATION_BASE      (0xF8)
437 #define SM501_CSC_CONTROL               (0xFC)
438 
439 /* 2d engine data port base */
440 #define SM501_2D_ENGINE_DATA            (0x110000)
441 
442 /* end of register definitions */
443 
444 #define SM501_HWC_WIDTH                       (64)
445 #define SM501_HWC_HEIGHT                      (64)
446 
447 /* SM501 local memory size taken from "linux/drivers/mfd/sm501.c" */
448 static const uint32_t sm501_mem_local_size[] = {
449     [0] = 4 * MiB,
450     [1] = 8 * MiB,
451     [2] = 16 * MiB,
452     [3] = 32 * MiB,
453     [4] = 64 * MiB,
454     [5] = 2 * MiB,
455 };
456 #define get_local_mem_size(s) sm501_mem_local_size[(s)->local_mem_size_index]
457 
458 typedef struct SM501State {
459     /* graphic console status */
460     QemuConsole *con;
461 
462     /* status & internal resources */
463     uint32_t local_mem_size_index;
464     uint8_t *local_mem;
465     MemoryRegion local_mem_region;
466     MemoryRegion mmio_region;
467     MemoryRegion system_config_region;
468     MemoryRegion i2c_region;
469     MemoryRegion disp_ctrl_region;
470     MemoryRegion twoD_engine_region;
471     uint32_t last_width;
472     uint32_t last_height;
473     bool do_full_update; /* perform a full update next time */
474     I2CBus *i2c_bus;
475 
476     /* mmio registers */
477     uint32_t system_control;
478     uint32_t misc_control;
479     uint32_t gpio_31_0_control;
480     uint32_t gpio_63_32_control;
481     uint32_t dram_control;
482     uint32_t arbitration_control;
483     uint32_t irq_mask;
484     uint32_t misc_timing;
485     uint32_t power_mode_control;
486 
487     uint8_t i2c_byte_count;
488     uint8_t i2c_status;
489     uint8_t i2c_addr;
490     uint8_t i2c_data[16];
491 
492     uint32_t uart0_ier;
493     uint32_t uart0_lcr;
494     uint32_t uart0_mcr;
495     uint32_t uart0_scr;
496 
497     uint8_t dc_palette[DC_PALETTE_ENTRIES];
498 
499     uint32_t dc_panel_control;
500     uint32_t dc_panel_panning_control;
501     uint32_t dc_panel_fb_addr;
502     uint32_t dc_panel_fb_offset;
503     uint32_t dc_panel_fb_width;
504     uint32_t dc_panel_fb_height;
505     uint32_t dc_panel_tl_location;
506     uint32_t dc_panel_br_location;
507     uint32_t dc_panel_h_total;
508     uint32_t dc_panel_h_sync;
509     uint32_t dc_panel_v_total;
510     uint32_t dc_panel_v_sync;
511 
512     uint32_t dc_panel_hwc_addr;
513     uint32_t dc_panel_hwc_location;
514     uint32_t dc_panel_hwc_color_1_2;
515     uint32_t dc_panel_hwc_color_3;
516 
517     uint32_t dc_video_control;
518 
519     uint32_t dc_crt_control;
520     uint32_t dc_crt_fb_addr;
521     uint32_t dc_crt_fb_offset;
522     uint32_t dc_crt_h_total;
523     uint32_t dc_crt_h_sync;
524     uint32_t dc_crt_v_total;
525     uint32_t dc_crt_v_sync;
526 
527     uint32_t dc_crt_hwc_addr;
528     uint32_t dc_crt_hwc_location;
529     uint32_t dc_crt_hwc_color_1_2;
530     uint32_t dc_crt_hwc_color_3;
531 
532     uint32_t twoD_source;
533     uint32_t twoD_destination;
534     uint32_t twoD_dimension;
535     uint32_t twoD_control;
536     uint32_t twoD_pitch;
537     uint32_t twoD_foreground;
538     uint32_t twoD_background;
539     uint32_t twoD_stretch;
540     uint32_t twoD_color_compare;
541     uint32_t twoD_color_compare_mask;
542     uint32_t twoD_mask;
543     uint32_t twoD_clip_tl;
544     uint32_t twoD_clip_br;
545     uint32_t twoD_mono_pattern_low;
546     uint32_t twoD_mono_pattern_high;
547     uint32_t twoD_window_width;
548     uint32_t twoD_source_base;
549     uint32_t twoD_destination_base;
550     uint32_t twoD_alpha;
551     uint32_t twoD_wrap;
552 } SM501State;
553 
554 static uint32_t get_local_mem_size_index(uint32_t size)
555 {
556     uint32_t norm_size = 0;
557     int i, index = 0;
558 
559     for (i = 0; i < ARRAY_SIZE(sm501_mem_local_size); i++) {
560         uint32_t new_size = sm501_mem_local_size[i];
561         if (new_size >= size) {
562             if (norm_size == 0 || norm_size > new_size) {
563                 norm_size = new_size;
564                 index = i;
565             }
566         }
567     }
568 
569     return index;
570 }
571 
572 static ram_addr_t get_fb_addr(SM501State *s, int crt)
573 {
574     return (crt ? s->dc_crt_fb_addr : s->dc_panel_fb_addr) & 0x3FFFFF0;
575 }
576 
577 static inline int get_width(SM501State *s, int crt)
578 {
579     int width = crt ? s->dc_crt_h_total : s->dc_panel_h_total;
580     return (width & 0x00000FFF) + 1;
581 }
582 
583 static inline int get_height(SM501State *s, int crt)
584 {
585     int height = crt ? s->dc_crt_v_total : s->dc_panel_v_total;
586     return (height & 0x00000FFF) + 1;
587 }
588 
589 static inline int get_bpp(SM501State *s, int crt)
590 {
591     int bpp = crt ? s->dc_crt_control : s->dc_panel_control;
592     return 1 << (bpp & 3);
593 }
594 
595 /**
596  * Check the availability of hardware cursor.
597  * @param crt  0 for PANEL, 1 for CRT.
598  */
599 static inline int is_hwc_enabled(SM501State *state, int crt)
600 {
601     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
602     return addr & SM501_HWC_EN;
603 }
604 
605 /**
606  * Get the address which holds cursor pattern data.
607  * @param crt  0 for PANEL, 1 for CRT.
608  */
609 static inline uint8_t *get_hwc_address(SM501State *state, int crt)
610 {
611     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
612     return state->local_mem + (addr & 0x03FFFFF0);
613 }
614 
615 /**
616  * Get the cursor position in y coordinate.
617  * @param crt  0 for PANEL, 1 for CRT.
618  */
619 static inline uint32_t get_hwc_y(SM501State *state, int crt)
620 {
621     uint32_t location = crt ? state->dc_crt_hwc_location
622                             : state->dc_panel_hwc_location;
623     return (location & 0x07FF0000) >> 16;
624 }
625 
626 /**
627  * Get the cursor position in x coordinate.
628  * @param crt  0 for PANEL, 1 for CRT.
629  */
630 static inline uint32_t get_hwc_x(SM501State *state, int crt)
631 {
632     uint32_t location = crt ? state->dc_crt_hwc_location
633                             : state->dc_panel_hwc_location;
634     return location & 0x000007FF;
635 }
636 
637 /**
638  * Get the hardware cursor palette.
639  * @param crt  0 for PANEL, 1 for CRT.
640  * @param palette  pointer to a [3 * 3] array to store color values in
641  */
642 static inline void get_hwc_palette(SM501State *state, int crt, uint8_t *palette)
643 {
644     int i;
645     uint32_t color_reg;
646     uint16_t rgb565;
647 
648     for (i = 0; i < 3; i++) {
649         if (i + 1 == 3) {
650             color_reg = crt ? state->dc_crt_hwc_color_3
651                             : state->dc_panel_hwc_color_3;
652         } else {
653             color_reg = crt ? state->dc_crt_hwc_color_1_2
654                             : state->dc_panel_hwc_color_1_2;
655         }
656 
657         if (i + 1 == 2) {
658             rgb565 = (color_reg >> 16) & 0xFFFF;
659         } else {
660             rgb565 = color_reg & 0xFFFF;
661         }
662         palette[i * 3 + 0] = ((rgb565 >> 11) * 527 + 23) >> 6; /* r */
663         palette[i * 3 + 1] = (((rgb565 >> 5) & 0x3f) * 259 + 33) >> 6; /* g */
664         palette[i * 3 + 2] = ((rgb565 & 0x1f) * 527 + 23) >> 6; /* b */
665     }
666 }
667 
668 static inline void hwc_invalidate(SM501State *s, int crt)
669 {
670     int w = get_width(s, crt);
671     int h = get_height(s, crt);
672     int bpp = get_bpp(s, crt);
673     int start = get_hwc_y(s, crt);
674     int end = MIN(h, start + SM501_HWC_HEIGHT) + 1;
675 
676     start *= w * bpp;
677     end *= w * bpp;
678 
679     memory_region_set_dirty(&s->local_mem_region,
680                             get_fb_addr(s, crt) + start, end - start);
681 }
682 
683 static void sm501_2d_operation(SM501State *s)
684 {
685     int cmd = (s->twoD_control >> 16) & 0x1F;
686     int rtl = s->twoD_control & BIT(27);
687     int format = (s->twoD_stretch >> 20) & 0x3;
688     int rop_mode = (s->twoD_control >> 15) & 0x1; /* 1 for rop2, else rop3 */
689     /* 1 if rop2 source is the pattern, otherwise the source is the bitmap */
690     int rop2_source_is_pattern = (s->twoD_control >> 14) & 0x1;
691     int rop = s->twoD_control & 0xFF;
692     unsigned int dst_x = (s->twoD_destination >> 16) & 0x01FFF;
693     unsigned int dst_y = s->twoD_destination & 0xFFFF;
694     unsigned int width = (s->twoD_dimension >> 16) & 0x1FFF;
695     unsigned int height = s->twoD_dimension & 0xFFFF;
696     uint32_t dst_base = s->twoD_destination_base & 0x03FFFFFF;
697     unsigned int dst_pitch = (s->twoD_pitch >> 16) & 0x1FFF;
698     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
699     int fb_len = get_width(s, crt) * get_height(s, crt) * get_bpp(s, crt);
700 
701     if ((s->twoD_stretch >> 16) & 0xF) {
702         qemu_log_mask(LOG_UNIMP, "sm501: only XY addressing is supported.\n");
703         return;
704     }
705 
706     if (s->twoD_source_base & BIT(27) || s->twoD_destination_base & BIT(27)) {
707         qemu_log_mask(LOG_UNIMP, "sm501: only local memory is supported.\n");
708         return;
709     }
710 
711     if (!dst_pitch) {
712         qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero dest pitch.\n");
713         return;
714     }
715 
716     if (!width || !height) {
717         qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero size 2D op.\n");
718         return;
719     }
720 
721     if (rtl) {
722         dst_x -= width - 1;
723         dst_y -= height - 1;
724     }
725 
726     if (dst_base >= get_local_mem_size(s) || dst_base +
727         (dst_x + width + (dst_y + height) * (dst_pitch + width)) *
728         (1 << format) >= get_local_mem_size(s)) {
729         qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
730         return;
731     }
732 
733     switch (cmd) {
734     case 0: /* BitBlt */
735     {
736         static uint32_t tmp_buf[16384];
737         unsigned int src_x = (s->twoD_source >> 16) & 0x01FFF;
738         unsigned int src_y = s->twoD_source & 0xFFFF;
739         uint32_t src_base = s->twoD_source_base & 0x03FFFFFF;
740         unsigned int src_pitch = s->twoD_pitch & 0x1FFF;
741 
742         if (!src_pitch) {
743             qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero src pitch.\n");
744             return;
745         }
746 
747         if (rtl) {
748             src_x -= width - 1;
749             src_y -= height - 1;
750         }
751 
752         if (src_base >= get_local_mem_size(s) || src_base +
753             (src_x + width + (src_y + height) * (src_pitch + width)) *
754             (1 << format) >= get_local_mem_size(s)) {
755             qemu_log_mask(LOG_GUEST_ERROR,
756                           "sm501: 2D op src is outside vram.\n");
757             return;
758         }
759 
760         if ((rop_mode && rop == 0x5) || (!rop_mode && rop == 0x55)) {
761             /* Invert dest, is there a way to do this with pixman? */
762             unsigned int x, y, i;
763             uint8_t *d = s->local_mem + dst_base;
764 
765             for (y = 0; y < height; y++) {
766                 i = (dst_x + (dst_y + y) * dst_pitch) * (1 << format);
767                 for (x = 0; x < width; x++, i += (1 << format)) {
768                     switch (format) {
769                     case 0:
770                         d[i] = ~d[i];
771                         break;
772                     case 1:
773                         *(uint16_t *)&d[i] = ~*(uint16_t *)&d[i];
774                         break;
775                     case 2:
776                         *(uint32_t *)&d[i] = ~*(uint32_t *)&d[i];
777                         break;
778                     }
779                 }
780             }
781         } else {
782             /* Do copy src for unimplemented ops, better than unpainted area */
783             if ((rop_mode && (rop != 0xc || rop2_source_is_pattern)) ||
784                 (!rop_mode && rop != 0xcc)) {
785                 qemu_log_mask(LOG_UNIMP,
786                               "sm501: rop%d op %x%s not implemented\n",
787                               (rop_mode ? 2 : 3), rop,
788                               (rop2_source_is_pattern ?
789                                   " with pattern source" : ""));
790             }
791             /* Check for overlaps, this could be made more exact */
792             uint32_t sb, se, db, de;
793             sb = src_base + src_x + src_y * (width + src_pitch);
794             se = sb + width + height * (width + src_pitch);
795             db = dst_base + dst_x + dst_y * (width + dst_pitch);
796             de = db + width + height * (width + dst_pitch);
797             if (rtl && ((db >= sb && db <= se) || (de >= sb && de <= se))) {
798                 /* regions may overlap: copy via temporary */
799                 int free_buf = 0, llb = width * (1 << format);
800                 int tmp_stride = DIV_ROUND_UP(llb, sizeof(uint32_t));
801                 uint32_t *tmp = tmp_buf;
802 
803                 if (tmp_stride * sizeof(uint32_t) * height > sizeof(tmp_buf)) {
804                     tmp = g_malloc(tmp_stride * sizeof(uint32_t) * height);
805                     free_buf = 1;
806                 }
807                 pixman_blt((uint32_t *)&s->local_mem[src_base], tmp,
808                            src_pitch * (1 << format) / sizeof(uint32_t),
809                            tmp_stride, 8 * (1 << format), 8 * (1 << format),
810                            src_x, src_y, 0, 0, width, height);
811                 pixman_blt(tmp, (uint32_t *)&s->local_mem[dst_base],
812                            tmp_stride,
813                            dst_pitch * (1 << format) / sizeof(uint32_t),
814                            8 * (1 << format), 8 * (1 << format),
815                            0, 0, dst_x, dst_y, width, height);
816                 if (free_buf) {
817                     g_free(tmp);
818                 }
819             } else {
820                 pixman_blt((uint32_t *)&s->local_mem[src_base],
821                            (uint32_t *)&s->local_mem[dst_base],
822                            src_pitch * (1 << format) / sizeof(uint32_t),
823                            dst_pitch * (1 << format) / sizeof(uint32_t),
824                            8 * (1 << format), 8 * (1 << format),
825                            src_x, src_y, dst_x, dst_y, width, height);
826             }
827         }
828         break;
829     }
830     case 1: /* Rectangle Fill */
831     {
832         uint32_t color = s->twoD_foreground;
833 
834         if (format == 2) {
835             color = cpu_to_le32(color);
836         } else if (format == 1) {
837             color = cpu_to_le16(color);
838         }
839 
840         pixman_fill((uint32_t *)&s->local_mem[dst_base],
841                     dst_pitch * (1 << format) / sizeof(uint32_t),
842                     8 * (1 << format), dst_x, dst_y, width, height, color);
843         break;
844     }
845     default:
846         qemu_log_mask(LOG_UNIMP, "sm501: not implemented 2D operation: %d\n",
847                       cmd);
848         return;
849     }
850 
851     if (dst_base >= get_fb_addr(s, crt) &&
852         dst_base <= get_fb_addr(s, crt) + fb_len) {
853         int dst_len = MIN(fb_len, ((dst_y + height - 1) * dst_pitch +
854                           dst_x + width) * (1 << format));
855         if (dst_len) {
856             memory_region_set_dirty(&s->local_mem_region, dst_base, dst_len);
857         }
858     }
859 }
860 
861 static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
862                                          unsigned size)
863 {
864     SM501State *s = (SM501State *)opaque;
865     uint32_t ret = 0;
866     SM501_DPRINTF("sm501 system config regs : read addr=%x\n", (int)addr);
867 
868     switch (addr) {
869     case SM501_SYSTEM_CONTROL:
870         ret = s->system_control;
871         break;
872     case SM501_MISC_CONTROL:
873         ret = s->misc_control;
874         break;
875     case SM501_GPIO31_0_CONTROL:
876         ret = s->gpio_31_0_control;
877         break;
878     case SM501_GPIO63_32_CONTROL:
879         ret = s->gpio_63_32_control;
880         break;
881     case SM501_DEVICEID:
882         ret = 0x050100A0;
883         break;
884     case SM501_DRAM_CONTROL:
885         ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
886         break;
887     case SM501_ARBTRTN_CONTROL:
888         ret = s->arbitration_control;
889         break;
890     case SM501_COMMAND_LIST_STATUS:
891         ret = 0x00180002; /* FIFOs are empty, everything idle */
892         break;
893     case SM501_IRQ_MASK:
894         ret = s->irq_mask;
895         break;
896     case SM501_MISC_TIMING:
897         /* TODO : simulate gate control */
898         ret = s->misc_timing;
899         break;
900     case SM501_CURRENT_GATE:
901         /* TODO : simulate gate control */
902         ret = 0x00021807;
903         break;
904     case SM501_CURRENT_CLOCK:
905         ret = 0x2A1A0A09;
906         break;
907     case SM501_POWER_MODE_CONTROL:
908         ret = s->power_mode_control;
909         break;
910     case SM501_ENDIAN_CONTROL:
911         ret = 0; /* Only default little endian mode is supported */
912         break;
913 
914     default:
915         qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
916                       "register read. addr=%" HWADDR_PRIx "\n", addr);
917     }
918 
919     return ret;
920 }
921 
922 static void sm501_system_config_write(void *opaque, hwaddr addr,
923                                       uint64_t value, unsigned size)
924 {
925     SM501State *s = (SM501State *)opaque;
926     SM501_DPRINTF("sm501 system config regs : write addr=%x, val=%x\n",
927                   (uint32_t)addr, (uint32_t)value);
928 
929     switch (addr) {
930     case SM501_SYSTEM_CONTROL:
931         s->system_control &= 0x10DB0000;
932         s->system_control |= value & 0xEF00B8F7;
933         break;
934     case SM501_MISC_CONTROL:
935         s->misc_control &= 0xEF;
936         s->misc_control |= value & 0xFF7FFF10;
937         break;
938     case SM501_GPIO31_0_CONTROL:
939         s->gpio_31_0_control = value;
940         break;
941     case SM501_GPIO63_32_CONTROL:
942         s->gpio_63_32_control = value & 0xFF80FFFF;
943         break;
944     case SM501_DRAM_CONTROL:
945         s->local_mem_size_index = (value >> 13) & 0x7;
946         /* TODO : check validity of size change */
947         s->dram_control &= 0x80000000;
948         s->dram_control |= value & 0x7FFFFFC3;
949         break;
950     case SM501_ARBTRTN_CONTROL:
951         s->arbitration_control = value & 0x37777777;
952         break;
953     case SM501_IRQ_MASK:
954         s->irq_mask = value & 0xFFDF3F5F;
955         break;
956     case SM501_MISC_TIMING:
957         s->misc_timing = value & 0xF31F1FFF;
958         break;
959     case SM501_POWER_MODE_0_GATE:
960     case SM501_POWER_MODE_1_GATE:
961     case SM501_POWER_MODE_0_CLOCK:
962     case SM501_POWER_MODE_1_CLOCK:
963         /* TODO : simulate gate & clock control */
964         break;
965     case SM501_POWER_MODE_CONTROL:
966         s->power_mode_control = value & 0x00000003;
967         break;
968     case SM501_ENDIAN_CONTROL:
969         if (value & 0x00000001) {
970             qemu_log_mask(LOG_UNIMP, "sm501: system config big endian mode not"
971                           " implemented.\n");
972         }
973         break;
974 
975     default:
976         qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
977                       "register write. addr=%" HWADDR_PRIx
978                       ", val=%" PRIx64 "\n", addr, value);
979     }
980 }
981 
982 static const MemoryRegionOps sm501_system_config_ops = {
983     .read = sm501_system_config_read,
984     .write = sm501_system_config_write,
985     .valid = {
986         .min_access_size = 4,
987         .max_access_size = 4,
988     },
989     .endianness = DEVICE_LITTLE_ENDIAN,
990 };
991 
992 static uint64_t sm501_i2c_read(void *opaque, hwaddr addr, unsigned size)
993 {
994     SM501State *s = (SM501State *)opaque;
995     uint8_t ret = 0;
996 
997     switch (addr) {
998     case SM501_I2C_BYTE_COUNT:
999         ret = s->i2c_byte_count;
1000         break;
1001     case SM501_I2C_STATUS:
1002         ret = s->i2c_status;
1003         break;
1004     case SM501_I2C_SLAVE_ADDRESS:
1005         ret = s->i2c_addr;
1006         break;
1007     case SM501_I2C_DATA ... SM501_I2C_DATA + 15:
1008         ret = s->i2c_data[addr - SM501_I2C_DATA];
1009         break;
1010     default:
1011         qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register read."
1012                       " addr=0x%" HWADDR_PRIx "\n", addr);
1013     }
1014 
1015     SM501_DPRINTF("sm501 i2c regs : read addr=%" HWADDR_PRIx " val=%x\n",
1016                   addr, ret);
1017     return ret;
1018 }
1019 
1020 static void sm501_i2c_write(void *opaque, hwaddr addr, uint64_t value,
1021                             unsigned size)
1022 {
1023     SM501State *s = (SM501State *)opaque;
1024     SM501_DPRINTF("sm501 i2c regs : write addr=%" HWADDR_PRIx
1025                   " val=%" PRIx64 "\n", addr, value);
1026 
1027     switch (addr) {
1028     case SM501_I2C_BYTE_COUNT:
1029         s->i2c_byte_count = value & 0xf;
1030         break;
1031     case SM501_I2C_CONTROL:
1032         if (value & SM501_I2C_CONTROL_ENABLE) {
1033             if (value & SM501_I2C_CONTROL_START) {
1034                 int res = i2c_start_transfer(s->i2c_bus,
1035                                              s->i2c_addr >> 1,
1036                                              s->i2c_addr & 1);
1037                 s->i2c_status |= (res ? SM501_I2C_STATUS_ERROR : 0);
1038                 if (!res) {
1039                     int i;
1040                     SM501_DPRINTF("sm501 i2c : transferring %d bytes to 0x%x\n",
1041                                   s->i2c_byte_count + 1, s->i2c_addr >> 1);
1042                     for (i = 0; i <= s->i2c_byte_count; i++) {
1043                         res = i2c_send_recv(s->i2c_bus, &s->i2c_data[i],
1044                                             !(s->i2c_addr & 1));
1045                         if (res) {
1046                             SM501_DPRINTF("sm501 i2c : transfer failed"
1047                                           " i=%d, res=%d\n", i, res);
1048                             s->i2c_status |= SM501_I2C_STATUS_ERROR;
1049                             return;
1050                         }
1051                     }
1052                     if (i) {
1053                         SM501_DPRINTF("sm501 i2c : transferred %d bytes\n", i);
1054                         s->i2c_status = SM501_I2C_STATUS_COMPLETE;
1055                     }
1056                 }
1057             } else {
1058                 SM501_DPRINTF("sm501 i2c : end transfer\n");
1059                 i2c_end_transfer(s->i2c_bus);
1060                 s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
1061             }
1062         }
1063         break;
1064     case SM501_I2C_RESET:
1065         if ((value & SM501_I2C_RESET_ERROR) == 0) {
1066             s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
1067         }
1068         break;
1069     case SM501_I2C_SLAVE_ADDRESS:
1070         s->i2c_addr = value & 0xff;
1071         break;
1072     case SM501_I2C_DATA ... SM501_I2C_DATA + 15:
1073         s->i2c_data[addr - SM501_I2C_DATA] = value & 0xff;
1074         break;
1075     default:
1076         qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register write. "
1077                       "addr=0x%" HWADDR_PRIx " val=%" PRIx64 "\n", addr, value);
1078     }
1079 }
1080 
1081 static const MemoryRegionOps sm501_i2c_ops = {
1082     .read = sm501_i2c_read,
1083     .write = sm501_i2c_write,
1084     .valid = {
1085         .min_access_size = 1,
1086         .max_access_size = 1,
1087     },
1088     .impl = {
1089         .min_access_size = 1,
1090         .max_access_size = 1,
1091     },
1092     .endianness = DEVICE_LITTLE_ENDIAN,
1093 };
1094 
1095 static uint32_t sm501_palette_read(void *opaque, hwaddr addr)
1096 {
1097     SM501State *s = (SM501State *)opaque;
1098     SM501_DPRINTF("sm501 palette read addr=%x\n", (int)addr);
1099 
1100     /* TODO : consider BYTE/WORD access */
1101     /* TODO : consider endian */
1102 
1103     assert(range_covers_byte(0, 0x400 * 3, addr));
1104     return *(uint32_t *)&s->dc_palette[addr];
1105 }
1106 
1107 static void sm501_palette_write(void *opaque, hwaddr addr,
1108                                 uint32_t value)
1109 {
1110     SM501State *s = (SM501State *)opaque;
1111     SM501_DPRINTF("sm501 palette write addr=%x, val=%x\n",
1112                   (int)addr, value);
1113 
1114     /* TODO : consider BYTE/WORD access */
1115     /* TODO : consider endian */
1116 
1117     assert(range_covers_byte(0, 0x400 * 3, addr));
1118     *(uint32_t *)&s->dc_palette[addr] = value;
1119     s->do_full_update = true;
1120 }
1121 
1122 static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr addr,
1123                                      unsigned size)
1124 {
1125     SM501State *s = (SM501State *)opaque;
1126     uint32_t ret = 0;
1127     SM501_DPRINTF("sm501 disp ctrl regs : read addr=%x\n", (int)addr);
1128 
1129     switch (addr) {
1130 
1131     case SM501_DC_PANEL_CONTROL:
1132         ret = s->dc_panel_control;
1133         break;
1134     case SM501_DC_PANEL_PANNING_CONTROL:
1135         ret = s->dc_panel_panning_control;
1136         break;
1137     case SM501_DC_PANEL_COLOR_KEY:
1138         /* Not implemented yet */
1139         break;
1140     case SM501_DC_PANEL_FB_ADDR:
1141         ret = s->dc_panel_fb_addr;
1142         break;
1143     case SM501_DC_PANEL_FB_OFFSET:
1144         ret = s->dc_panel_fb_offset;
1145         break;
1146     case SM501_DC_PANEL_FB_WIDTH:
1147         ret = s->dc_panel_fb_width;
1148         break;
1149     case SM501_DC_PANEL_FB_HEIGHT:
1150         ret = s->dc_panel_fb_height;
1151         break;
1152     case SM501_DC_PANEL_TL_LOC:
1153         ret = s->dc_panel_tl_location;
1154         break;
1155     case SM501_DC_PANEL_BR_LOC:
1156         ret = s->dc_panel_br_location;
1157         break;
1158 
1159     case SM501_DC_PANEL_H_TOT:
1160         ret = s->dc_panel_h_total;
1161         break;
1162     case SM501_DC_PANEL_H_SYNC:
1163         ret = s->dc_panel_h_sync;
1164         break;
1165     case SM501_DC_PANEL_V_TOT:
1166         ret = s->dc_panel_v_total;
1167         break;
1168     case SM501_DC_PANEL_V_SYNC:
1169         ret = s->dc_panel_v_sync;
1170         break;
1171 
1172     case SM501_DC_PANEL_HWC_ADDR:
1173         ret = s->dc_panel_hwc_addr;
1174         break;
1175     case SM501_DC_PANEL_HWC_LOC:
1176         ret = s->dc_panel_hwc_location;
1177         break;
1178     case SM501_DC_PANEL_HWC_COLOR_1_2:
1179         ret = s->dc_panel_hwc_color_1_2;
1180         break;
1181     case SM501_DC_PANEL_HWC_COLOR_3:
1182         ret = s->dc_panel_hwc_color_3;
1183         break;
1184 
1185     case SM501_DC_VIDEO_CONTROL:
1186         ret = s->dc_video_control;
1187         break;
1188 
1189     case SM501_DC_CRT_CONTROL:
1190         ret = s->dc_crt_control;
1191         break;
1192     case SM501_DC_CRT_FB_ADDR:
1193         ret = s->dc_crt_fb_addr;
1194         break;
1195     case SM501_DC_CRT_FB_OFFSET:
1196         ret = s->dc_crt_fb_offset;
1197         break;
1198     case SM501_DC_CRT_H_TOT:
1199         ret = s->dc_crt_h_total;
1200         break;
1201     case SM501_DC_CRT_H_SYNC:
1202         ret = s->dc_crt_h_sync;
1203         break;
1204     case SM501_DC_CRT_V_TOT:
1205         ret = s->dc_crt_v_total;
1206         break;
1207     case SM501_DC_CRT_V_SYNC:
1208         ret = s->dc_crt_v_sync;
1209         break;
1210 
1211     case SM501_DC_CRT_HWC_ADDR:
1212         ret = s->dc_crt_hwc_addr;
1213         break;
1214     case SM501_DC_CRT_HWC_LOC:
1215         ret = s->dc_crt_hwc_location;
1216         break;
1217     case SM501_DC_CRT_HWC_COLOR_1_2:
1218         ret = s->dc_crt_hwc_color_1_2;
1219         break;
1220     case SM501_DC_CRT_HWC_COLOR_3:
1221         ret = s->dc_crt_hwc_color_3;
1222         break;
1223 
1224     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1225         ret = sm501_palette_read(opaque, addr - SM501_DC_PANEL_PALETTE);
1226         break;
1227 
1228     default:
1229         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1230                       "read. addr=%" HWADDR_PRIx "\n", addr);
1231     }
1232 
1233     return ret;
1234 }
1235 
1236 static void sm501_disp_ctrl_write(void *opaque, hwaddr addr,
1237                                   uint64_t value, unsigned size)
1238 {
1239     SM501State *s = (SM501State *)opaque;
1240     SM501_DPRINTF("sm501 disp ctrl regs : write addr=%x, val=%x\n",
1241                   (unsigned)addr, (unsigned)value);
1242 
1243     switch (addr) {
1244     case SM501_DC_PANEL_CONTROL:
1245         s->dc_panel_control = value & 0x0FFF73FF;
1246         break;
1247     case SM501_DC_PANEL_PANNING_CONTROL:
1248         s->dc_panel_panning_control = value & 0xFF3FFF3F;
1249         break;
1250     case SM501_DC_PANEL_COLOR_KEY:
1251         /* Not implemented yet */
1252         break;
1253     case SM501_DC_PANEL_FB_ADDR:
1254         s->dc_panel_fb_addr = value & 0x8FFFFFF0;
1255         if (value & 0x8000000) {
1256             qemu_log_mask(LOG_UNIMP, "Panel external memory not supported\n");
1257         }
1258         s->do_full_update = true;
1259         break;
1260     case SM501_DC_PANEL_FB_OFFSET:
1261         s->dc_panel_fb_offset = value & 0x3FF03FF0;
1262         break;
1263     case SM501_DC_PANEL_FB_WIDTH:
1264         s->dc_panel_fb_width = value & 0x0FFF0FFF;
1265         break;
1266     case SM501_DC_PANEL_FB_HEIGHT:
1267         s->dc_panel_fb_height = value & 0x0FFF0FFF;
1268         break;
1269     case SM501_DC_PANEL_TL_LOC:
1270         s->dc_panel_tl_location = value & 0x07FF07FF;
1271         break;
1272     case SM501_DC_PANEL_BR_LOC:
1273         s->dc_panel_br_location = value & 0x07FF07FF;
1274         break;
1275 
1276     case SM501_DC_PANEL_H_TOT:
1277         s->dc_panel_h_total = value & 0x0FFF0FFF;
1278         break;
1279     case SM501_DC_PANEL_H_SYNC:
1280         s->dc_panel_h_sync = value & 0x00FF0FFF;
1281         break;
1282     case SM501_DC_PANEL_V_TOT:
1283         s->dc_panel_v_total = value & 0x0FFF0FFF;
1284         break;
1285     case SM501_DC_PANEL_V_SYNC:
1286         s->dc_panel_v_sync = value & 0x003F0FFF;
1287         break;
1288 
1289     case SM501_DC_PANEL_HWC_ADDR:
1290         value &= 0x8FFFFFF0;
1291         if (value != s->dc_panel_hwc_addr) {
1292             hwc_invalidate(s, 0);
1293             s->dc_panel_hwc_addr = value;
1294         }
1295         break;
1296     case SM501_DC_PANEL_HWC_LOC:
1297         value &= 0x0FFF0FFF;
1298         if (value != s->dc_panel_hwc_location) {
1299             hwc_invalidate(s, 0);
1300             s->dc_panel_hwc_location = value;
1301         }
1302         break;
1303     case SM501_DC_PANEL_HWC_COLOR_1_2:
1304         s->dc_panel_hwc_color_1_2 = value;
1305         break;
1306     case SM501_DC_PANEL_HWC_COLOR_3:
1307         s->dc_panel_hwc_color_3 = value & 0x0000FFFF;
1308         break;
1309 
1310     case SM501_DC_VIDEO_CONTROL:
1311         s->dc_video_control = value & 0x00037FFF;
1312         break;
1313 
1314     case SM501_DC_CRT_CONTROL:
1315         s->dc_crt_control = value & 0x0003FFFF;
1316         break;
1317     case SM501_DC_CRT_FB_ADDR:
1318         s->dc_crt_fb_addr = value & 0x8FFFFFF0;
1319         if (value & 0x8000000) {
1320             qemu_log_mask(LOG_UNIMP, "CRT external memory not supported\n");
1321         }
1322         s->do_full_update = true;
1323         break;
1324     case SM501_DC_CRT_FB_OFFSET:
1325         s->dc_crt_fb_offset = value & 0x3FF03FF0;
1326         break;
1327     case SM501_DC_CRT_H_TOT:
1328         s->dc_crt_h_total = value & 0x0FFF0FFF;
1329         break;
1330     case SM501_DC_CRT_H_SYNC:
1331         s->dc_crt_h_sync = value & 0x00FF0FFF;
1332         break;
1333     case SM501_DC_CRT_V_TOT:
1334         s->dc_crt_v_total = value & 0x0FFF0FFF;
1335         break;
1336     case SM501_DC_CRT_V_SYNC:
1337         s->dc_crt_v_sync = value & 0x003F0FFF;
1338         break;
1339 
1340     case SM501_DC_CRT_HWC_ADDR:
1341         value &= 0x8FFFFFF0;
1342         if (value != s->dc_crt_hwc_addr) {
1343             hwc_invalidate(s, 1);
1344             s->dc_crt_hwc_addr = value;
1345         }
1346         break;
1347     case SM501_DC_CRT_HWC_LOC:
1348         value &= 0x0FFF0FFF;
1349         if (value != s->dc_crt_hwc_location) {
1350             hwc_invalidate(s, 1);
1351             s->dc_crt_hwc_location = value;
1352         }
1353         break;
1354     case SM501_DC_CRT_HWC_COLOR_1_2:
1355         s->dc_crt_hwc_color_1_2 = value;
1356         break;
1357     case SM501_DC_CRT_HWC_COLOR_3:
1358         s->dc_crt_hwc_color_3 = value & 0x0000FFFF;
1359         break;
1360 
1361     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1362         sm501_palette_write(opaque, addr - SM501_DC_PANEL_PALETTE, value);
1363         break;
1364 
1365     default:
1366         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1367                       "write. addr=%" HWADDR_PRIx
1368                       ", val=%" PRIx64 "\n", addr, value);
1369     }
1370 }
1371 
1372 static const MemoryRegionOps sm501_disp_ctrl_ops = {
1373     .read = sm501_disp_ctrl_read,
1374     .write = sm501_disp_ctrl_write,
1375     .valid = {
1376         .min_access_size = 4,
1377         .max_access_size = 4,
1378     },
1379     .endianness = DEVICE_LITTLE_ENDIAN,
1380 };
1381 
1382 static uint64_t sm501_2d_engine_read(void *opaque, hwaddr addr,
1383                                      unsigned size)
1384 {
1385     SM501State *s = (SM501State *)opaque;
1386     uint32_t ret = 0;
1387     SM501_DPRINTF("sm501 2d engine regs : read addr=%x\n", (int)addr);
1388 
1389     switch (addr) {
1390     case SM501_2D_SOURCE:
1391         ret = s->twoD_source;
1392         break;
1393     case SM501_2D_DESTINATION:
1394         ret = s->twoD_destination;
1395         break;
1396     case SM501_2D_DIMENSION:
1397         ret = s->twoD_dimension;
1398         break;
1399     case SM501_2D_CONTROL:
1400         ret = s->twoD_control;
1401         break;
1402     case SM501_2D_PITCH:
1403         ret = s->twoD_pitch;
1404         break;
1405     case SM501_2D_FOREGROUND:
1406         ret = s->twoD_foreground;
1407         break;
1408     case SM501_2D_BACKGROUND:
1409         ret = s->twoD_background;
1410         break;
1411     case SM501_2D_STRETCH:
1412         ret = s->twoD_stretch;
1413         break;
1414     case SM501_2D_COLOR_COMPARE:
1415         ret = s->twoD_color_compare;
1416         break;
1417     case SM501_2D_COLOR_COMPARE_MASK:
1418         ret = s->twoD_color_compare_mask;
1419         break;
1420     case SM501_2D_MASK:
1421         ret = s->twoD_mask;
1422         break;
1423     case SM501_2D_CLIP_TL:
1424         ret = s->twoD_clip_tl;
1425         break;
1426     case SM501_2D_CLIP_BR:
1427         ret = s->twoD_clip_br;
1428         break;
1429     case SM501_2D_MONO_PATTERN_LOW:
1430         ret = s->twoD_mono_pattern_low;
1431         break;
1432     case SM501_2D_MONO_PATTERN_HIGH:
1433         ret = s->twoD_mono_pattern_high;
1434         break;
1435     case SM501_2D_WINDOW_WIDTH:
1436         ret = s->twoD_window_width;
1437         break;
1438     case SM501_2D_SOURCE_BASE:
1439         ret = s->twoD_source_base;
1440         break;
1441     case SM501_2D_DESTINATION_BASE:
1442         ret = s->twoD_destination_base;
1443         break;
1444     case SM501_2D_ALPHA:
1445         ret = s->twoD_alpha;
1446         break;
1447     case SM501_2D_WRAP:
1448         ret = s->twoD_wrap;
1449         break;
1450     case SM501_2D_STATUS:
1451         ret = 0; /* Should return interrupt status */
1452         break;
1453     default:
1454         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1455                       "read. addr=%" HWADDR_PRIx "\n", addr);
1456     }
1457 
1458     return ret;
1459 }
1460 
1461 static void sm501_2d_engine_write(void *opaque, hwaddr addr,
1462                                   uint64_t value, unsigned size)
1463 {
1464     SM501State *s = (SM501State *)opaque;
1465     SM501_DPRINTF("sm501 2d engine regs : write addr=%x, val=%x\n",
1466                   (unsigned)addr, (unsigned)value);
1467 
1468     switch (addr) {
1469     case SM501_2D_SOURCE:
1470         s->twoD_source = value;
1471         break;
1472     case SM501_2D_DESTINATION:
1473         s->twoD_destination = value;
1474         break;
1475     case SM501_2D_DIMENSION:
1476         s->twoD_dimension = value;
1477         break;
1478     case SM501_2D_CONTROL:
1479         s->twoD_control = value;
1480 
1481         /* do 2d operation if start flag is set. */
1482         if (value & 0x80000000) {
1483             sm501_2d_operation(s);
1484             s->twoD_control &= ~0x80000000; /* start flag down */
1485         }
1486 
1487         break;
1488     case SM501_2D_PITCH:
1489         s->twoD_pitch = value;
1490         break;
1491     case SM501_2D_FOREGROUND:
1492         s->twoD_foreground = value;
1493         break;
1494     case SM501_2D_BACKGROUND:
1495         s->twoD_background = value;
1496         break;
1497     case SM501_2D_STRETCH:
1498         s->twoD_stretch = value;
1499         break;
1500     case SM501_2D_COLOR_COMPARE:
1501         s->twoD_color_compare = value;
1502         break;
1503     case SM501_2D_COLOR_COMPARE_MASK:
1504         s->twoD_color_compare_mask = value;
1505         break;
1506     case SM501_2D_MASK:
1507         s->twoD_mask = value;
1508         break;
1509     case SM501_2D_CLIP_TL:
1510         s->twoD_clip_tl = value;
1511         break;
1512     case SM501_2D_CLIP_BR:
1513         s->twoD_clip_br = value;
1514         break;
1515     case SM501_2D_MONO_PATTERN_LOW:
1516         s->twoD_mono_pattern_low = value;
1517         break;
1518     case SM501_2D_MONO_PATTERN_HIGH:
1519         s->twoD_mono_pattern_high = value;
1520         break;
1521     case SM501_2D_WINDOW_WIDTH:
1522         s->twoD_window_width = value;
1523         break;
1524     case SM501_2D_SOURCE_BASE:
1525         s->twoD_source_base = value;
1526         break;
1527     case SM501_2D_DESTINATION_BASE:
1528         s->twoD_destination_base = value;
1529         break;
1530     case SM501_2D_ALPHA:
1531         s->twoD_alpha = value;
1532         break;
1533     case SM501_2D_WRAP:
1534         s->twoD_wrap = value;
1535         break;
1536     case SM501_2D_STATUS:
1537         /* ignored, writing 0 should clear interrupt status */
1538         break;
1539     default:
1540         qemu_log_mask(LOG_UNIMP, "sm501: not implemented 2d engine register "
1541                       "write. addr=%" HWADDR_PRIx
1542                       ", val=%" PRIx64 "\n", addr, value);
1543     }
1544 }
1545 
1546 static const MemoryRegionOps sm501_2d_engine_ops = {
1547     .read = sm501_2d_engine_read,
1548     .write = sm501_2d_engine_write,
1549     .valid = {
1550         .min_access_size = 4,
1551         .max_access_size = 4,
1552     },
1553     .endianness = DEVICE_LITTLE_ENDIAN,
1554 };
1555 
1556 /* draw line functions for all console modes */
1557 
1558 typedef void draw_line_func(uint8_t *d, const uint8_t *s,
1559                             int width, const uint32_t *pal);
1560 
1561 typedef void draw_hwc_line_func(uint8_t *d, const uint8_t *s,
1562                                 int width, const uint8_t *palette,
1563                                 int c_x, int c_y);
1564 
1565 #define DEPTH 8
1566 #include "sm501_template.h"
1567 
1568 #define DEPTH 15
1569 #include "sm501_template.h"
1570 
1571 #define BGR_FORMAT
1572 #define DEPTH 15
1573 #include "sm501_template.h"
1574 
1575 #define DEPTH 16
1576 #include "sm501_template.h"
1577 
1578 #define BGR_FORMAT
1579 #define DEPTH 16
1580 #include "sm501_template.h"
1581 
1582 #define DEPTH 32
1583 #include "sm501_template.h"
1584 
1585 #define BGR_FORMAT
1586 #define DEPTH 32
1587 #include "sm501_template.h"
1588 
1589 static draw_line_func *draw_line8_funcs[] = {
1590     draw_line8_8,
1591     draw_line8_15,
1592     draw_line8_16,
1593     draw_line8_32,
1594     draw_line8_32bgr,
1595     draw_line8_15bgr,
1596     draw_line8_16bgr,
1597 };
1598 
1599 static draw_line_func *draw_line16_funcs[] = {
1600     draw_line16_8,
1601     draw_line16_15,
1602     draw_line16_16,
1603     draw_line16_32,
1604     draw_line16_32bgr,
1605     draw_line16_15bgr,
1606     draw_line16_16bgr,
1607 };
1608 
1609 static draw_line_func *draw_line32_funcs[] = {
1610     draw_line32_8,
1611     draw_line32_15,
1612     draw_line32_16,
1613     draw_line32_32,
1614     draw_line32_32bgr,
1615     draw_line32_15bgr,
1616     draw_line32_16bgr,
1617 };
1618 
1619 static draw_hwc_line_func *draw_hwc_line_funcs[] = {
1620     draw_hwc_line_8,
1621     draw_hwc_line_15,
1622     draw_hwc_line_16,
1623     draw_hwc_line_32,
1624     draw_hwc_line_32bgr,
1625     draw_hwc_line_15bgr,
1626     draw_hwc_line_16bgr,
1627 };
1628 
1629 static inline int get_depth_index(DisplaySurface *surface)
1630 {
1631     switch (surface_bits_per_pixel(surface)) {
1632     default:
1633     case 8:
1634         return 0;
1635     case 15:
1636         return 1;
1637     case 16:
1638         return 2;
1639     case 32:
1640         if (is_surface_bgr(surface)) {
1641             return 4;
1642         } else {
1643             return 3;
1644         }
1645     }
1646 }
1647 
1648 static void sm501_update_display(void *opaque)
1649 {
1650     SM501State *s = (SM501State *)opaque;
1651     DisplaySurface *surface = qemu_console_surface(s->con);
1652     DirtyBitmapSnapshot *snap;
1653     int y, c_x = 0, c_y = 0;
1654     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
1655     int width = get_width(s, crt);
1656     int height = get_height(s, crt);
1657     int src_bpp = get_bpp(s, crt);
1658     int dst_bpp = surface_bytes_per_pixel(surface);
1659     int dst_depth_index = get_depth_index(surface);
1660     draw_line_func *draw_line = NULL;
1661     draw_hwc_line_func *draw_hwc_line = NULL;
1662     int full_update = 0;
1663     int y_start = -1;
1664     ram_addr_t offset;
1665     uint32_t *palette;
1666     uint8_t hwc_palette[3 * 3];
1667     uint8_t *hwc_src = NULL;
1668 
1669     if (!((crt ? s->dc_crt_control : s->dc_panel_control)
1670           & SM501_DC_CRT_CONTROL_ENABLE)) {
1671         return;
1672     }
1673 
1674     palette = (uint32_t *)(crt ? &s->dc_palette[SM501_DC_CRT_PALETTE -
1675                                                 SM501_DC_PANEL_PALETTE]
1676                                : &s->dc_palette[0]);
1677 
1678     /* choose draw_line function */
1679     switch (src_bpp) {
1680     case 1:
1681         draw_line = draw_line8_funcs[dst_depth_index];
1682         break;
1683     case 2:
1684         draw_line = draw_line16_funcs[dst_depth_index];
1685         break;
1686     case 4:
1687         draw_line = draw_line32_funcs[dst_depth_index];
1688         break;
1689     default:
1690         qemu_log_mask(LOG_GUEST_ERROR, "sm501: update display"
1691                       "invalid control register value.\n");
1692         return;
1693     }
1694 
1695     /* set up to draw hardware cursor */
1696     if (is_hwc_enabled(s, crt)) {
1697         /* choose cursor draw line function */
1698         draw_hwc_line = draw_hwc_line_funcs[dst_depth_index];
1699         hwc_src = get_hwc_address(s, crt);
1700         c_x = get_hwc_x(s, crt);
1701         c_y = get_hwc_y(s, crt);
1702         get_hwc_palette(s, crt, hwc_palette);
1703     }
1704 
1705     /* adjust console size */
1706     if (s->last_width != width || s->last_height != height) {
1707         qemu_console_resize(s->con, width, height);
1708         surface = qemu_console_surface(s->con);
1709         s->last_width = width;
1710         s->last_height = height;
1711         full_update = 1;
1712     }
1713 
1714     /* someone else requested a full update */
1715     if (s->do_full_update) {
1716         s->do_full_update = false;
1717         full_update = 1;
1718     }
1719 
1720     /* draw each line according to conditions */
1721     offset = get_fb_addr(s, crt);
1722     snap = memory_region_snapshot_and_clear_dirty(&s->local_mem_region,
1723               offset, width * height * src_bpp, DIRTY_MEMORY_VGA);
1724     for (y = 0; y < height; y++, offset += width * src_bpp) {
1725         int update, update_hwc;
1726 
1727         /* check if hardware cursor is enabled and we're within its range */
1728         update_hwc = draw_hwc_line && c_y <= y && y < c_y + SM501_HWC_HEIGHT;
1729         update = full_update || update_hwc;
1730         /* check dirty flags for each line */
1731         update |= memory_region_snapshot_get_dirty(&s->local_mem_region, snap,
1732                                                    offset, width * src_bpp);
1733 
1734         /* draw line and change status */
1735         if (update) {
1736             uint8_t *d = surface_data(surface);
1737             d +=  y * width * dst_bpp;
1738 
1739             /* draw graphics layer */
1740             draw_line(d, s->local_mem + offset, width, palette);
1741 
1742             /* draw hardware cursor */
1743             if (update_hwc) {
1744                 draw_hwc_line(d, hwc_src, width, hwc_palette, c_x, y - c_y);
1745             }
1746 
1747             if (y_start < 0) {
1748                 y_start = y;
1749             }
1750         } else {
1751             if (y_start >= 0) {
1752                 /* flush to display */
1753                 dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1754                 y_start = -1;
1755             }
1756         }
1757     }
1758     g_free(snap);
1759 
1760     /* complete flush to display */
1761     if (y_start >= 0) {
1762         dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1763     }
1764 }
1765 
1766 static const GraphicHwOps sm501_ops = {
1767     .gfx_update  = sm501_update_display,
1768 };
1769 
1770 static void sm501_reset(SM501State *s)
1771 {
1772     s->system_control = 0x00100000; /* 2D engine FIFO empty */
1773     /* Bits 17 (SH), 7 (CDR), 6:5 (Test), 2:0 (Bus) are all supposed
1774      * to be determined at reset by GPIO lines which set config bits.
1775      * We hardwire them:
1776      *  SH = 0 : Hitachi Ready Polarity == Active Low
1777      *  CDR = 0 : do not reset clock divider
1778      *  TEST = 0 : Normal mode (not testing the silicon)
1779      *  BUS = 0 : Hitachi SH3/SH4
1780      */
1781     s->misc_control = SM501_MISC_DAC_POWER;
1782     s->gpio_31_0_control = 0;
1783     s->gpio_63_32_control = 0;
1784     s->dram_control = 0;
1785     s->arbitration_control = 0x05146732;
1786     s->irq_mask = 0;
1787     s->misc_timing = 0;
1788     s->power_mode_control = 0;
1789     s->i2c_byte_count = 0;
1790     s->i2c_status = 0;
1791     s->i2c_addr = 0;
1792     memset(s->i2c_data, 0, 16);
1793     s->dc_panel_control = 0x00010000; /* FIFO level 3 */
1794     s->dc_video_control = 0;
1795     s->dc_crt_control = 0x00010000;
1796     s->twoD_source = 0;
1797     s->twoD_destination = 0;
1798     s->twoD_dimension = 0;
1799     s->twoD_control = 0;
1800     s->twoD_pitch = 0;
1801     s->twoD_foreground = 0;
1802     s->twoD_background = 0;
1803     s->twoD_stretch = 0;
1804     s->twoD_color_compare = 0;
1805     s->twoD_color_compare_mask = 0;
1806     s->twoD_mask = 0;
1807     s->twoD_clip_tl = 0;
1808     s->twoD_clip_br = 0;
1809     s->twoD_mono_pattern_low = 0;
1810     s->twoD_mono_pattern_high = 0;
1811     s->twoD_window_width = 0;
1812     s->twoD_source_base = 0;
1813     s->twoD_destination_base = 0;
1814     s->twoD_alpha = 0;
1815     s->twoD_wrap = 0;
1816 }
1817 
1818 static void sm501_init(SM501State *s, DeviceState *dev,
1819                        uint32_t local_mem_bytes)
1820 {
1821     s->local_mem_size_index = get_local_mem_size_index(local_mem_bytes);
1822     SM501_DPRINTF("sm501 local mem size=%x. index=%d\n", get_local_mem_size(s),
1823                   s->local_mem_size_index);
1824 
1825     /* local memory */
1826     memory_region_init_ram(&s->local_mem_region, OBJECT(dev), "sm501.local",
1827                            get_local_mem_size(s), &error_fatal);
1828     memory_region_set_log(&s->local_mem_region, true, DIRTY_MEMORY_VGA);
1829     s->local_mem = memory_region_get_ram_ptr(&s->local_mem_region);
1830 
1831     /* i2c */
1832     s->i2c_bus = i2c_init_bus(dev, "sm501.i2c");
1833     /* ddc */
1834     I2CDDCState *ddc = I2CDDC(qdev_create(BUS(s->i2c_bus), TYPE_I2CDDC));
1835     i2c_set_slave_address(I2C_SLAVE(ddc), 0x50);
1836 
1837     /* mmio */
1838     memory_region_init(&s->mmio_region, OBJECT(dev), "sm501.mmio", MMIO_SIZE);
1839     memory_region_init_io(&s->system_config_region, OBJECT(dev),
1840                           &sm501_system_config_ops, s,
1841                           "sm501-system-config", 0x6c);
1842     memory_region_add_subregion(&s->mmio_region, SM501_SYS_CONFIG,
1843                                 &s->system_config_region);
1844     memory_region_init_io(&s->i2c_region, OBJECT(dev), &sm501_i2c_ops, s,
1845                           "sm501-i2c", 0x14);
1846     memory_region_add_subregion(&s->mmio_region, SM501_I2C, &s->i2c_region);
1847     memory_region_init_io(&s->disp_ctrl_region, OBJECT(dev),
1848                           &sm501_disp_ctrl_ops, s,
1849                           "sm501-disp-ctrl", 0x1000);
1850     memory_region_add_subregion(&s->mmio_region, SM501_DC,
1851                                 &s->disp_ctrl_region);
1852     memory_region_init_io(&s->twoD_engine_region, OBJECT(dev),
1853                           &sm501_2d_engine_ops, s,
1854                           "sm501-2d-engine", 0x54);
1855     memory_region_add_subregion(&s->mmio_region, SM501_2D_ENGINE,
1856                                 &s->twoD_engine_region);
1857 
1858     /* create qemu graphic console */
1859     s->con = graphic_console_init(dev, 0, &sm501_ops, s);
1860 }
1861 
1862 static const VMStateDescription vmstate_sm501_state = {
1863     .name = "sm501-state",
1864     .version_id = 1,
1865     .minimum_version_id = 1,
1866     .fields = (VMStateField[]) {
1867         VMSTATE_UINT32(local_mem_size_index, SM501State),
1868         VMSTATE_UINT32(system_control, SM501State),
1869         VMSTATE_UINT32(misc_control, SM501State),
1870         VMSTATE_UINT32(gpio_31_0_control, SM501State),
1871         VMSTATE_UINT32(gpio_63_32_control, SM501State),
1872         VMSTATE_UINT32(dram_control, SM501State),
1873         VMSTATE_UINT32(arbitration_control, SM501State),
1874         VMSTATE_UINT32(irq_mask, SM501State),
1875         VMSTATE_UINT32(misc_timing, SM501State),
1876         VMSTATE_UINT32(power_mode_control, SM501State),
1877         VMSTATE_UINT32(uart0_ier, SM501State),
1878         VMSTATE_UINT32(uart0_lcr, SM501State),
1879         VMSTATE_UINT32(uart0_mcr, SM501State),
1880         VMSTATE_UINT32(uart0_scr, SM501State),
1881         VMSTATE_UINT8_ARRAY(dc_palette, SM501State, DC_PALETTE_ENTRIES),
1882         VMSTATE_UINT32(dc_panel_control, SM501State),
1883         VMSTATE_UINT32(dc_panel_panning_control, SM501State),
1884         VMSTATE_UINT32(dc_panel_fb_addr, SM501State),
1885         VMSTATE_UINT32(dc_panel_fb_offset, SM501State),
1886         VMSTATE_UINT32(dc_panel_fb_width, SM501State),
1887         VMSTATE_UINT32(dc_panel_fb_height, SM501State),
1888         VMSTATE_UINT32(dc_panel_tl_location, SM501State),
1889         VMSTATE_UINT32(dc_panel_br_location, SM501State),
1890         VMSTATE_UINT32(dc_panel_h_total, SM501State),
1891         VMSTATE_UINT32(dc_panel_h_sync, SM501State),
1892         VMSTATE_UINT32(dc_panel_v_total, SM501State),
1893         VMSTATE_UINT32(dc_panel_v_sync, SM501State),
1894         VMSTATE_UINT32(dc_panel_hwc_addr, SM501State),
1895         VMSTATE_UINT32(dc_panel_hwc_location, SM501State),
1896         VMSTATE_UINT32(dc_panel_hwc_color_1_2, SM501State),
1897         VMSTATE_UINT32(dc_panel_hwc_color_3, SM501State),
1898         VMSTATE_UINT32(dc_video_control, SM501State),
1899         VMSTATE_UINT32(dc_crt_control, SM501State),
1900         VMSTATE_UINT32(dc_crt_fb_addr, SM501State),
1901         VMSTATE_UINT32(dc_crt_fb_offset, SM501State),
1902         VMSTATE_UINT32(dc_crt_h_total, SM501State),
1903         VMSTATE_UINT32(dc_crt_h_sync, SM501State),
1904         VMSTATE_UINT32(dc_crt_v_total, SM501State),
1905         VMSTATE_UINT32(dc_crt_v_sync, SM501State),
1906         VMSTATE_UINT32(dc_crt_hwc_addr, SM501State),
1907         VMSTATE_UINT32(dc_crt_hwc_location, SM501State),
1908         VMSTATE_UINT32(dc_crt_hwc_color_1_2, SM501State),
1909         VMSTATE_UINT32(dc_crt_hwc_color_3, SM501State),
1910         VMSTATE_UINT32(twoD_source, SM501State),
1911         VMSTATE_UINT32(twoD_destination, SM501State),
1912         VMSTATE_UINT32(twoD_dimension, SM501State),
1913         VMSTATE_UINT32(twoD_control, SM501State),
1914         VMSTATE_UINT32(twoD_pitch, SM501State),
1915         VMSTATE_UINT32(twoD_foreground, SM501State),
1916         VMSTATE_UINT32(twoD_background, SM501State),
1917         VMSTATE_UINT32(twoD_stretch, SM501State),
1918         VMSTATE_UINT32(twoD_color_compare, SM501State),
1919         VMSTATE_UINT32(twoD_color_compare_mask, SM501State),
1920         VMSTATE_UINT32(twoD_mask, SM501State),
1921         VMSTATE_UINT32(twoD_clip_tl, SM501State),
1922         VMSTATE_UINT32(twoD_clip_br, SM501State),
1923         VMSTATE_UINT32(twoD_mono_pattern_low, SM501State),
1924         VMSTATE_UINT32(twoD_mono_pattern_high, SM501State),
1925         VMSTATE_UINT32(twoD_window_width, SM501State),
1926         VMSTATE_UINT32(twoD_source_base, SM501State),
1927         VMSTATE_UINT32(twoD_destination_base, SM501State),
1928         VMSTATE_UINT32(twoD_alpha, SM501State),
1929         VMSTATE_UINT32(twoD_wrap, SM501State),
1930         /* Added in version 2 */
1931         VMSTATE_UINT8(i2c_byte_count, SM501State),
1932         VMSTATE_UINT8(i2c_status, SM501State),
1933         VMSTATE_UINT8(i2c_addr, SM501State),
1934         VMSTATE_UINT8_ARRAY(i2c_data, SM501State, 16),
1935         VMSTATE_END_OF_LIST()
1936      }
1937 };
1938 
1939 #define TYPE_SYSBUS_SM501 "sysbus-sm501"
1940 #define SYSBUS_SM501(obj) \
1941     OBJECT_CHECK(SM501SysBusState, (obj), TYPE_SYSBUS_SM501)
1942 
1943 typedef struct {
1944     /*< private >*/
1945     SysBusDevice parent_obj;
1946     /*< public >*/
1947     SM501State state;
1948     uint32_t vram_size;
1949     uint32_t base;
1950     SerialMM serial;
1951 } SM501SysBusState;
1952 
1953 static void sm501_realize_sysbus(DeviceState *dev, Error **errp)
1954 {
1955     SM501SysBusState *s = SYSBUS_SM501(dev);
1956     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1957     DeviceState *usb_dev;
1958     MemoryRegion *mr;
1959 
1960     sm501_init(&s->state, dev, s->vram_size);
1961     if (get_local_mem_size(&s->state) != s->vram_size) {
1962         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
1963                    get_local_mem_size(&s->state));
1964         return;
1965     }
1966     sysbus_init_mmio(sbd, &s->state.local_mem_region);
1967     sysbus_init_mmio(sbd, &s->state.mmio_region);
1968 
1969     /* bridge to usb host emulation module */
1970     usb_dev = qdev_create(NULL, "sysbus-ohci");
1971     qdev_prop_set_uint32(usb_dev, "num-ports", 2);
1972     qdev_prop_set_uint64(usb_dev, "dma-offset", s->base);
1973     qdev_init_nofail(usb_dev);
1974     memory_region_add_subregion(&s->state.mmio_region, SM501_USB_HOST,
1975                        sysbus_mmio_get_region(SYS_BUS_DEVICE(usb_dev), 0));
1976     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(usb_dev));
1977 
1978     /* bridge to serial emulation module */
1979     qdev_init_nofail(DEVICE(&s->serial));
1980     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->serial), 0);
1981     memory_region_add_subregion(&s->state.mmio_region, SM501_UART0, mr);
1982     /* TODO : chain irq to IRL */
1983 }
1984 
1985 static Property sm501_sysbus_properties[] = {
1986     DEFINE_PROP_UINT32("vram-size", SM501SysBusState, vram_size, 0),
1987     DEFINE_PROP_UINT32("base", SM501SysBusState, base, 0),
1988     DEFINE_PROP_END_OF_LIST(),
1989 };
1990 
1991 static void sm501_reset_sysbus(DeviceState *dev)
1992 {
1993     SM501SysBusState *s = SYSBUS_SM501(dev);
1994     sm501_reset(&s->state);
1995 }
1996 
1997 static const VMStateDescription vmstate_sm501_sysbus = {
1998     .name = TYPE_SYSBUS_SM501,
1999     .version_id = 2,
2000     .minimum_version_id = 2,
2001     .fields = (VMStateField[]) {
2002         VMSTATE_STRUCT(state, SM501SysBusState, 1,
2003                        vmstate_sm501_state, SM501State),
2004         VMSTATE_END_OF_LIST()
2005      }
2006 };
2007 
2008 static void sm501_sysbus_class_init(ObjectClass *klass, void *data)
2009 {
2010     DeviceClass *dc = DEVICE_CLASS(klass);
2011 
2012     dc->realize = sm501_realize_sysbus;
2013     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2014     dc->desc = "SM501 Multimedia Companion";
2015     device_class_set_props(dc, sm501_sysbus_properties);
2016     dc->reset = sm501_reset_sysbus;
2017     dc->vmsd = &vmstate_sm501_sysbus;
2018 }
2019 
2020 static void sm501_sysbus_init(Object *o)
2021 {
2022     SM501SysBusState *sm501 = SYSBUS_SM501(o);
2023     SerialMM *smm = &sm501->serial;
2024 
2025     sysbus_init_child_obj(o, "serial", smm, sizeof(SerialMM), TYPE_SERIAL_MM);
2026     qdev_set_legacy_instance_id(DEVICE(smm), SM501_UART0, 2);
2027     qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
2028     qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
2029 
2030     object_property_add_alias(o, "chardev",
2031                               OBJECT(smm), "chardev");
2032 }
2033 
2034 static const TypeInfo sm501_sysbus_info = {
2035     .name          = TYPE_SYSBUS_SM501,
2036     .parent        = TYPE_SYS_BUS_DEVICE,
2037     .instance_size = sizeof(SM501SysBusState),
2038     .class_init    = sm501_sysbus_class_init,
2039     .instance_init = sm501_sysbus_init,
2040 };
2041 
2042 #define TYPE_PCI_SM501 "sm501"
2043 #define PCI_SM501(obj) OBJECT_CHECK(SM501PCIState, (obj), TYPE_PCI_SM501)
2044 
2045 typedef struct {
2046     /*< private >*/
2047     PCIDevice parent_obj;
2048     /*< public >*/
2049     SM501State state;
2050     uint32_t vram_size;
2051 } SM501PCIState;
2052 
2053 static void sm501_realize_pci(PCIDevice *dev, Error **errp)
2054 {
2055     SM501PCIState *s = PCI_SM501(dev);
2056 
2057     sm501_init(&s->state, DEVICE(dev), s->vram_size);
2058     if (get_local_mem_size(&s->state) != s->vram_size) {
2059         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
2060                    get_local_mem_size(&s->state));
2061         return;
2062     }
2063     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
2064                      &s->state.local_mem_region);
2065     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY,
2066                      &s->state.mmio_region);
2067 }
2068 
2069 static Property sm501_pci_properties[] = {
2070     DEFINE_PROP_UINT32("vram-size", SM501PCIState, vram_size, 64 * MiB),
2071     DEFINE_PROP_END_OF_LIST(),
2072 };
2073 
2074 static void sm501_reset_pci(DeviceState *dev)
2075 {
2076     SM501PCIState *s = PCI_SM501(dev);
2077     sm501_reset(&s->state);
2078     /* Bits 2:0 of misc_control register is 001 for PCI */
2079     s->state.misc_control |= 1;
2080 }
2081 
2082 static const VMStateDescription vmstate_sm501_pci = {
2083     .name = TYPE_PCI_SM501,
2084     .version_id = 2,
2085     .minimum_version_id = 2,
2086     .fields = (VMStateField[]) {
2087         VMSTATE_PCI_DEVICE(parent_obj, SM501PCIState),
2088         VMSTATE_STRUCT(state, SM501PCIState, 1,
2089                        vmstate_sm501_state, SM501State),
2090         VMSTATE_END_OF_LIST()
2091      }
2092 };
2093 
2094 static void sm501_pci_class_init(ObjectClass *klass, void *data)
2095 {
2096     DeviceClass *dc = DEVICE_CLASS(klass);
2097     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2098 
2099     k->realize = sm501_realize_pci;
2100     k->vendor_id = PCI_VENDOR_ID_SILICON_MOTION;
2101     k->device_id = PCI_DEVICE_ID_SM501;
2102     k->class_id = PCI_CLASS_DISPLAY_OTHER;
2103     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2104     dc->desc = "SM501 Display Controller";
2105     device_class_set_props(dc, sm501_pci_properties);
2106     dc->reset = sm501_reset_pci;
2107     dc->hotpluggable = false;
2108     dc->vmsd = &vmstate_sm501_pci;
2109 }
2110 
2111 static const TypeInfo sm501_pci_info = {
2112     .name          = TYPE_PCI_SM501,
2113     .parent        = TYPE_PCI_DEVICE,
2114     .instance_size = sizeof(SM501PCIState),
2115     .class_init    = sm501_pci_class_init,
2116     .interfaces = (InterfaceInfo[]) {
2117         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2118         { },
2119     },
2120 };
2121 
2122 static void sm501_register_types(void)
2123 {
2124     type_register_static(&sm501_sysbus_info);
2125     type_register_static(&sm501_pci_info);
2126 }
2127 
2128 type_init(sm501_register_types)
2129