xref: /openbmc/qemu/hw/display/sm501.c (revision 7b571ef3)
1 /*
2  * QEMU SM501 Device
3  *
4  * Copyright (c) 2008 Shin-ichiro KAWASAKI
5  * Copyright (c) 2016-2020 BALATON Zoltan
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "qemu/units.h"
28 #include "qapi/error.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "hw/usb/hcd-ohci.h"
32 #include "hw/char/serial.h"
33 #include "ui/console.h"
34 #include "hw/sysbus.h"
35 #include "migration/vmstate.h"
36 #include "hw/pci/pci_device.h"
37 #include "hw/qdev-properties.h"
38 #include "hw/i2c/i2c.h"
39 #include "hw/display/i2c-ddc.h"
40 #include "qemu/range.h"
41 #include "ui/pixel_ops.h"
42 #include "qemu/bswap.h"
43 #include "trace.h"
44 #include "qom/object.h"
45 
46 #define MMIO_BASE_OFFSET 0x3e00000
47 #define MMIO_SIZE 0x200000
48 #define DC_PALETTE_ENTRIES (0x400 * 3)
49 
50 /* SM501 register definitions taken from "linux/include/linux/sm501-regs.h" */
51 
52 /* System Configuration area */
53 /* System config base */
54 #define SM501_SYS_CONFIG                0x000000
55 
56 /* config 1 */
57 #define SM501_SYSTEM_CONTROL            0x000000
58 
59 #define SM501_SYSCTRL_PANEL_TRISTATE    (1 << 0)
60 #define SM501_SYSCTRL_MEM_TRISTATE      (1 << 1)
61 #define SM501_SYSCTRL_CRT_TRISTATE      (1 << 2)
62 
63 #define SM501_SYSCTRL_PCI_SLAVE_BURST_MASK (3 << 4)
64 #define SM501_SYSCTRL_PCI_SLAVE_BURST_1 (0 << 4)
65 #define SM501_SYSCTRL_PCI_SLAVE_BURST_2 (1 << 4)
66 #define SM501_SYSCTRL_PCI_SLAVE_BURST_4 (2 << 4)
67 #define SM501_SYSCTRL_PCI_SLAVE_BURST_8 (3 << 4)
68 
69 #define SM501_SYSCTRL_PCI_CLOCK_RUN_EN  (1 << 6)
70 #define SM501_SYSCTRL_PCI_RETRY_DISABLE (1 << 7)
71 #define SM501_SYSCTRL_PCI_SUBSYS_LOCK   (1 << 11)
72 #define SM501_SYSCTRL_PCI_BURST_READ_EN (1 << 15)
73 
74 /* miscellaneous control */
75 
76 #define SM501_MISC_CONTROL              0x000004
77 
78 #define SM501_MISC_BUS_SH               0x0
79 #define SM501_MISC_BUS_PCI              0x1
80 #define SM501_MISC_BUS_XSCALE           0x2
81 #define SM501_MISC_BUS_NEC              0x6
82 #define SM501_MISC_BUS_MASK             0x7
83 
84 #define SM501_MISC_VR_62MB              (1 << 3)
85 #define SM501_MISC_CDR_RESET            (1 << 7)
86 #define SM501_MISC_USB_LB               (1 << 8)
87 #define SM501_MISC_USB_SLAVE            (1 << 9)
88 #define SM501_MISC_BL_1                 (1 << 10)
89 #define SM501_MISC_MC                   (1 << 11)
90 #define SM501_MISC_DAC_POWER            (1 << 12)
91 #define SM501_MISC_IRQ_INVERT           (1 << 16)
92 #define SM501_MISC_SH                   (1 << 17)
93 
94 #define SM501_MISC_HOLD_EMPTY           (0 << 18)
95 #define SM501_MISC_HOLD_8               (1 << 18)
96 #define SM501_MISC_HOLD_16              (2 << 18)
97 #define SM501_MISC_HOLD_24              (3 << 18)
98 #define SM501_MISC_HOLD_32              (4 << 18)
99 #define SM501_MISC_HOLD_MASK            (7 << 18)
100 
101 #define SM501_MISC_FREQ_12              (1 << 24)
102 #define SM501_MISC_PNL_24BIT            (1 << 25)
103 #define SM501_MISC_8051_LE              (1 << 26)
104 
105 
106 
107 #define SM501_GPIO31_0_CONTROL          0x000008
108 #define SM501_GPIO63_32_CONTROL         0x00000C
109 #define SM501_DRAM_CONTROL              0x000010
110 
111 /* command list */
112 #define SM501_ARBTRTN_CONTROL           0x000014
113 
114 /* command list */
115 #define SM501_COMMAND_LIST_STATUS       0x000024
116 
117 /* interrupt debug */
118 #define SM501_RAW_IRQ_STATUS            0x000028
119 #define SM501_RAW_IRQ_CLEAR             0x000028
120 #define SM501_IRQ_STATUS                0x00002C
121 #define SM501_IRQ_MASK                  0x000030
122 #define SM501_DEBUG_CONTROL             0x000034
123 
124 /* power management */
125 #define SM501_POWERMODE_P2X_SRC         (1 << 29)
126 #define SM501_POWERMODE_V2X_SRC         (1 << 20)
127 #define SM501_POWERMODE_M_SRC           (1 << 12)
128 #define SM501_POWERMODE_M1_SRC          (1 << 4)
129 
130 #define SM501_CURRENT_GATE              0x000038
131 #define SM501_CURRENT_CLOCK             0x00003C
132 #define SM501_POWER_MODE_0_GATE         0x000040
133 #define SM501_POWER_MODE_0_CLOCK        0x000044
134 #define SM501_POWER_MODE_1_GATE         0x000048
135 #define SM501_POWER_MODE_1_CLOCK        0x00004C
136 #define SM501_SLEEP_MODE_GATE           0x000050
137 #define SM501_POWER_MODE_CONTROL        0x000054
138 
139 /* power gates for units within the 501 */
140 #define SM501_GATE_HOST                 0
141 #define SM501_GATE_MEMORY               1
142 #define SM501_GATE_DISPLAY              2
143 #define SM501_GATE_2D_ENGINE            3
144 #define SM501_GATE_CSC                  4
145 #define SM501_GATE_ZVPORT               5
146 #define SM501_GATE_GPIO                 6
147 #define SM501_GATE_UART0                7
148 #define SM501_GATE_UART1                8
149 #define SM501_GATE_SSP                  10
150 #define SM501_GATE_USB_HOST             11
151 #define SM501_GATE_USB_GADGET           12
152 #define SM501_GATE_UCONTROLLER          17
153 #define SM501_GATE_AC97                 18
154 
155 /* panel clock */
156 #define SM501_CLOCK_P2XCLK              24
157 /* crt clock */
158 #define SM501_CLOCK_V2XCLK              16
159 /* main clock */
160 #define SM501_CLOCK_MCLK                8
161 /* SDRAM controller clock */
162 #define SM501_CLOCK_M1XCLK              0
163 
164 /* config 2 */
165 #define SM501_PCI_MASTER_BASE           0x000058
166 #define SM501_ENDIAN_CONTROL            0x00005C
167 #define SM501_DEVICEID                  0x000060
168 /* 0x050100A0 */
169 
170 #define SM501_DEVICEID_SM501            0x05010000
171 #define SM501_DEVICEID_IDMASK           0xffff0000
172 #define SM501_DEVICEID_REVMASK          0x000000ff
173 
174 #define SM501_PLLCLOCK_COUNT            0x000064
175 #define SM501_MISC_TIMING               0x000068
176 #define SM501_CURRENT_SDRAM_CLOCK       0x00006C
177 
178 #define SM501_PROGRAMMABLE_PLL_CONTROL  0x000074
179 
180 /* GPIO base */
181 #define SM501_GPIO                      0x010000
182 #define SM501_GPIO_DATA_LOW             0x00
183 #define SM501_GPIO_DATA_HIGH            0x04
184 #define SM501_GPIO_DDR_LOW              0x08
185 #define SM501_GPIO_DDR_HIGH             0x0C
186 #define SM501_GPIO_IRQ_SETUP            0x10
187 #define SM501_GPIO_IRQ_STATUS           0x14
188 #define SM501_GPIO_IRQ_RESET            0x14
189 
190 /* I2C controller base */
191 #define SM501_I2C                       0x010040
192 #define SM501_I2C_BYTE_COUNT            0x00
193 #define SM501_I2C_CONTROL               0x01
194 #define SM501_I2C_STATUS                0x02
195 #define SM501_I2C_RESET                 0x02
196 #define SM501_I2C_SLAVE_ADDRESS         0x03
197 #define SM501_I2C_DATA                  0x04
198 
199 #define SM501_I2C_CONTROL_START         (1 << 2)
200 #define SM501_I2C_CONTROL_ENABLE        (1 << 0)
201 
202 #define SM501_I2C_STATUS_COMPLETE       (1 << 3)
203 #define SM501_I2C_STATUS_ERROR          (1 << 2)
204 
205 #define SM501_I2C_RESET_ERROR           (1 << 2)
206 
207 /* SSP base */
208 #define SM501_SSP                       0x020000
209 
210 /* Uart 0 base */
211 #define SM501_UART0                     0x030000
212 
213 /* Uart 1 base */
214 #define SM501_UART1                     0x030020
215 
216 /* USB host port base */
217 #define SM501_USB_HOST                  0x040000
218 
219 /* USB slave/gadget base */
220 #define SM501_USB_GADGET                0x060000
221 
222 /* USB slave/gadget data port base */
223 #define SM501_USB_GADGET_DATA           0x070000
224 
225 /* Display controller/video engine base */
226 #define SM501_DC                        0x080000
227 
228 /* common defines for the SM501 address registers */
229 #define SM501_ADDR_FLIP                 (1 << 31)
230 #define SM501_ADDR_EXT                  (1 << 27)
231 #define SM501_ADDR_CS1                  (1 << 26)
232 #define SM501_ADDR_MASK                 (0x3f << 26)
233 
234 #define SM501_FIFO_MASK                 (0x3 << 16)
235 #define SM501_FIFO_1                    (0x0 << 16)
236 #define SM501_FIFO_3                    (0x1 << 16)
237 #define SM501_FIFO_7                    (0x2 << 16)
238 #define SM501_FIFO_11                   (0x3 << 16)
239 
240 /* common registers for panel and the crt */
241 #define SM501_OFF_DC_H_TOT              0x000
242 #define SM501_OFF_DC_V_TOT              0x008
243 #define SM501_OFF_DC_H_SYNC             0x004
244 #define SM501_OFF_DC_V_SYNC             0x00C
245 
246 #define SM501_DC_PANEL_CONTROL          0x000
247 
248 #define SM501_DC_PANEL_CONTROL_FPEN     (1 << 27)
249 #define SM501_DC_PANEL_CONTROL_BIAS     (1 << 26)
250 #define SM501_DC_PANEL_CONTROL_DATA     (1 << 25)
251 #define SM501_DC_PANEL_CONTROL_VDD      (1 << 24)
252 #define SM501_DC_PANEL_CONTROL_DP       (1 << 23)
253 
254 #define SM501_DC_PANEL_CONTROL_TFT_888  (0 << 21)
255 #define SM501_DC_PANEL_CONTROL_TFT_333  (1 << 21)
256 #define SM501_DC_PANEL_CONTROL_TFT_444  (2 << 21)
257 
258 #define SM501_DC_PANEL_CONTROL_DE       (1 << 20)
259 
260 #define SM501_DC_PANEL_CONTROL_LCD_TFT  (0 << 18)
261 #define SM501_DC_PANEL_CONTROL_LCD_STN8 (1 << 18)
262 #define SM501_DC_PANEL_CONTROL_LCD_STN12 (2 << 18)
263 
264 #define SM501_DC_PANEL_CONTROL_CP       (1 << 14)
265 #define SM501_DC_PANEL_CONTROL_VSP      (1 << 13)
266 #define SM501_DC_PANEL_CONTROL_HSP      (1 << 12)
267 #define SM501_DC_PANEL_CONTROL_CK       (1 << 9)
268 #define SM501_DC_PANEL_CONTROL_TE       (1 << 8)
269 #define SM501_DC_PANEL_CONTROL_VPD      (1 << 7)
270 #define SM501_DC_PANEL_CONTROL_VP       (1 << 6)
271 #define SM501_DC_PANEL_CONTROL_HPD      (1 << 5)
272 #define SM501_DC_PANEL_CONTROL_HP       (1 << 4)
273 #define SM501_DC_PANEL_CONTROL_GAMMA    (1 << 3)
274 #define SM501_DC_PANEL_CONTROL_EN       (1 << 2)
275 
276 #define SM501_DC_PANEL_CONTROL_8BPP     (0 << 0)
277 #define SM501_DC_PANEL_CONTROL_16BPP    (1 << 0)
278 #define SM501_DC_PANEL_CONTROL_32BPP    (2 << 0)
279 
280 
281 #define SM501_DC_PANEL_PANNING_CONTROL  0x004
282 #define SM501_DC_PANEL_COLOR_KEY        0x008
283 #define SM501_DC_PANEL_FB_ADDR          0x00C
284 #define SM501_DC_PANEL_FB_OFFSET        0x010
285 #define SM501_DC_PANEL_FB_WIDTH         0x014
286 #define SM501_DC_PANEL_FB_HEIGHT        0x018
287 #define SM501_DC_PANEL_TL_LOC           0x01C
288 #define SM501_DC_PANEL_BR_LOC           0x020
289 #define SM501_DC_PANEL_H_TOT            0x024
290 #define SM501_DC_PANEL_H_SYNC           0x028
291 #define SM501_DC_PANEL_V_TOT            0x02C
292 #define SM501_DC_PANEL_V_SYNC           0x030
293 #define SM501_DC_PANEL_CUR_LINE         0x034
294 
295 #define SM501_DC_VIDEO_CONTROL          0x040
296 #define SM501_DC_VIDEO_FB0_ADDR         0x044
297 #define SM501_DC_VIDEO_FB_WIDTH         0x048
298 #define SM501_DC_VIDEO_FB0_LAST_ADDR    0x04C
299 #define SM501_DC_VIDEO_TL_LOC           0x050
300 #define SM501_DC_VIDEO_BR_LOC           0x054
301 #define SM501_DC_VIDEO_SCALE            0x058
302 #define SM501_DC_VIDEO_INIT_SCALE       0x05C
303 #define SM501_DC_VIDEO_YUV_CONSTANTS    0x060
304 #define SM501_DC_VIDEO_FB1_ADDR         0x064
305 #define SM501_DC_VIDEO_FB1_LAST_ADDR    0x068
306 
307 #define SM501_DC_VIDEO_ALPHA_CONTROL    0x080
308 #define SM501_DC_VIDEO_ALPHA_FB_ADDR    0x084
309 #define SM501_DC_VIDEO_ALPHA_FB_OFFSET  0x088
310 #define SM501_DC_VIDEO_ALPHA_FB_LAST_ADDR 0x08C
311 #define SM501_DC_VIDEO_ALPHA_TL_LOC     0x090
312 #define SM501_DC_VIDEO_ALPHA_BR_LOC     0x094
313 #define SM501_DC_VIDEO_ALPHA_SCALE      0x098
314 #define SM501_DC_VIDEO_ALPHA_INIT_SCALE 0x09C
315 #define SM501_DC_VIDEO_ALPHA_CHROMA_KEY 0x0A0
316 #define SM501_DC_VIDEO_ALPHA_COLOR_LOOKUP 0x0A4
317 
318 #define SM501_DC_PANEL_HWC_BASE         0x0F0
319 #define SM501_DC_PANEL_HWC_ADDR         0x0F0
320 #define SM501_DC_PANEL_HWC_LOC          0x0F4
321 #define SM501_DC_PANEL_HWC_COLOR_1_2    0x0F8
322 #define SM501_DC_PANEL_HWC_COLOR_3      0x0FC
323 
324 #define SM501_HWC_EN                    (1 << 31)
325 
326 #define SM501_OFF_HWC_ADDR              0x00
327 #define SM501_OFF_HWC_LOC               0x04
328 #define SM501_OFF_HWC_COLOR_1_2         0x08
329 #define SM501_OFF_HWC_COLOR_3           0x0C
330 
331 #define SM501_DC_ALPHA_CONTROL          0x100
332 #define SM501_DC_ALPHA_FB_ADDR          0x104
333 #define SM501_DC_ALPHA_FB_OFFSET        0x108
334 #define SM501_DC_ALPHA_TL_LOC           0x10C
335 #define SM501_DC_ALPHA_BR_LOC           0x110
336 #define SM501_DC_ALPHA_CHROMA_KEY       0x114
337 #define SM501_DC_ALPHA_COLOR_LOOKUP     0x118
338 
339 #define SM501_DC_CRT_CONTROL            0x200
340 
341 #define SM501_DC_CRT_CONTROL_TVP        (1 << 15)
342 #define SM501_DC_CRT_CONTROL_CP         (1 << 14)
343 #define SM501_DC_CRT_CONTROL_VSP        (1 << 13)
344 #define SM501_DC_CRT_CONTROL_HSP        (1 << 12)
345 #define SM501_DC_CRT_CONTROL_VS         (1 << 11)
346 #define SM501_DC_CRT_CONTROL_BLANK      (1 << 10)
347 #define SM501_DC_CRT_CONTROL_SEL        (1 << 9)
348 #define SM501_DC_CRT_CONTROL_TE         (1 << 8)
349 #define SM501_DC_CRT_CONTROL_PIXEL_MASK (0xF << 4)
350 #define SM501_DC_CRT_CONTROL_GAMMA      (1 << 3)
351 #define SM501_DC_CRT_CONTROL_ENABLE     (1 << 2)
352 
353 #define SM501_DC_CRT_CONTROL_8BPP       (0 << 0)
354 #define SM501_DC_CRT_CONTROL_16BPP      (1 << 0)
355 #define SM501_DC_CRT_CONTROL_32BPP      (2 << 0)
356 
357 #define SM501_DC_CRT_FB_ADDR            0x204
358 #define SM501_DC_CRT_FB_OFFSET          0x208
359 #define SM501_DC_CRT_H_TOT              0x20C
360 #define SM501_DC_CRT_H_SYNC             0x210
361 #define SM501_DC_CRT_V_TOT              0x214
362 #define SM501_DC_CRT_V_SYNC             0x218
363 #define SM501_DC_CRT_SIGNATURE_ANALYZER 0x21C
364 #define SM501_DC_CRT_CUR_LINE           0x220
365 #define SM501_DC_CRT_MONITOR_DETECT     0x224
366 
367 #define SM501_DC_CRT_HWC_BASE           0x230
368 #define SM501_DC_CRT_HWC_ADDR           0x230
369 #define SM501_DC_CRT_HWC_LOC            0x234
370 #define SM501_DC_CRT_HWC_COLOR_1_2      0x238
371 #define SM501_DC_CRT_HWC_COLOR_3        0x23C
372 
373 #define SM501_DC_PANEL_PALETTE          0x400
374 
375 #define SM501_DC_VIDEO_PALETTE          0x800
376 
377 #define SM501_DC_CRT_PALETTE            0xC00
378 
379 /* Zoom Video port base */
380 #define SM501_ZVPORT                    0x090000
381 
382 /* AC97/I2S base */
383 #define SM501_AC97                      0x0A0000
384 
385 /* 8051 micro controller base */
386 #define SM501_UCONTROLLER               0x0B0000
387 
388 /* 8051 micro controller SRAM base */
389 #define SM501_UCONTROLLER_SRAM          0x0C0000
390 
391 /* DMA base */
392 #define SM501_DMA                       0x0D0000
393 
394 /* 2d engine base */
395 #define SM501_2D_ENGINE                 0x100000
396 #define SM501_2D_SOURCE                 0x00
397 #define SM501_2D_DESTINATION            0x04
398 #define SM501_2D_DIMENSION              0x08
399 #define SM501_2D_CONTROL                0x0C
400 #define SM501_2D_PITCH                  0x10
401 #define SM501_2D_FOREGROUND             0x14
402 #define SM501_2D_BACKGROUND             0x18
403 #define SM501_2D_STRETCH                0x1C
404 #define SM501_2D_COLOR_COMPARE          0x20
405 #define SM501_2D_COLOR_COMPARE_MASK     0x24
406 #define SM501_2D_MASK                   0x28
407 #define SM501_2D_CLIP_TL                0x2C
408 #define SM501_2D_CLIP_BR                0x30
409 #define SM501_2D_MONO_PATTERN_LOW       0x34
410 #define SM501_2D_MONO_PATTERN_HIGH      0x38
411 #define SM501_2D_WINDOW_WIDTH           0x3C
412 #define SM501_2D_SOURCE_BASE            0x40
413 #define SM501_2D_DESTINATION_BASE       0x44
414 #define SM501_2D_ALPHA                  0x48
415 #define SM501_2D_WRAP                   0x4C
416 #define SM501_2D_STATUS                 0x50
417 
418 #define SM501_CSC_Y_SOURCE_BASE         0xC8
419 #define SM501_CSC_CONSTANTS             0xCC
420 #define SM501_CSC_Y_SOURCE_X            0xD0
421 #define SM501_CSC_Y_SOURCE_Y            0xD4
422 #define SM501_CSC_U_SOURCE_BASE         0xD8
423 #define SM501_CSC_V_SOURCE_BASE         0xDC
424 #define SM501_CSC_SOURCE_DIMENSION      0xE0
425 #define SM501_CSC_SOURCE_PITCH          0xE4
426 #define SM501_CSC_DESTINATION           0xE8
427 #define SM501_CSC_DESTINATION_DIMENSION 0xEC
428 #define SM501_CSC_DESTINATION_PITCH     0xF0
429 #define SM501_CSC_SCALE_FACTOR          0xF4
430 #define SM501_CSC_DESTINATION_BASE      0xF8
431 #define SM501_CSC_CONTROL               0xFC
432 
433 /* 2d engine data port base */
434 #define SM501_2D_ENGINE_DATA            0x110000
435 
436 /* end of register definitions */
437 
438 #define SM501_HWC_WIDTH                 64
439 #define SM501_HWC_HEIGHT                64
440 
441 #ifdef CONFIG_PIXMAN
442 #define DEFAULT_X_PIXMAN 7
443 #else
444 #define DEFAULT_X_PIXMAN 0
445 #endif
446 
447 /* SM501 local memory size taken from "linux/drivers/mfd/sm501.c" */
448 static const uint32_t sm501_mem_local_size[] = {
449     [0] = 4 * MiB,
450     [1] = 8 * MiB,
451     [2] = 16 * MiB,
452     [3] = 32 * MiB,
453     [4] = 64 * MiB,
454     [5] = 2 * MiB,
455 };
456 #define get_local_mem_size(s) sm501_mem_local_size[(s)->local_mem_size_index]
457 
458 typedef struct SM501State {
459     /* graphic console status */
460     QemuConsole *con;
461 
462     /* status & internal resources */
463     uint32_t local_mem_size_index;
464     uint8_t *local_mem;
465     MemoryRegion local_mem_region;
466     MemoryRegion mmio_region;
467     MemoryRegion system_config_region;
468     MemoryRegion i2c_region;
469     MemoryRegion disp_ctrl_region;
470     MemoryRegion twoD_engine_region;
471     uint32_t last_width;
472     uint32_t last_height;
473     bool do_full_update; /* perform a full update next time */
474     uint8_t use_pixman;
475     I2CBus *i2c_bus;
476 
477     /* mmio registers */
478     uint32_t system_control;
479     uint32_t misc_control;
480     uint32_t gpio_31_0_control;
481     uint32_t gpio_63_32_control;
482     uint32_t dram_control;
483     uint32_t arbitration_control;
484     uint32_t irq_mask;
485     uint32_t misc_timing;
486     uint32_t power_mode_control;
487 
488     uint8_t i2c_byte_count;
489     uint8_t i2c_status;
490     uint8_t i2c_addr;
491     uint8_t i2c_data[16];
492 
493     uint32_t uart0_ier;
494     uint32_t uart0_lcr;
495     uint32_t uart0_mcr;
496     uint32_t uart0_scr;
497 
498     uint8_t dc_palette[DC_PALETTE_ENTRIES];
499 
500     uint32_t dc_panel_control;
501     uint32_t dc_panel_panning_control;
502     uint32_t dc_panel_fb_addr;
503     uint32_t dc_panel_fb_offset;
504     uint32_t dc_panel_fb_width;
505     uint32_t dc_panel_fb_height;
506     uint32_t dc_panel_tl_location;
507     uint32_t dc_panel_br_location;
508     uint32_t dc_panel_h_total;
509     uint32_t dc_panel_h_sync;
510     uint32_t dc_panel_v_total;
511     uint32_t dc_panel_v_sync;
512 
513     uint32_t dc_panel_hwc_addr;
514     uint32_t dc_panel_hwc_location;
515     uint32_t dc_panel_hwc_color_1_2;
516     uint32_t dc_panel_hwc_color_3;
517 
518     uint32_t dc_video_control;
519 
520     uint32_t dc_crt_control;
521     uint32_t dc_crt_fb_addr;
522     uint32_t dc_crt_fb_offset;
523     uint32_t dc_crt_h_total;
524     uint32_t dc_crt_h_sync;
525     uint32_t dc_crt_v_total;
526     uint32_t dc_crt_v_sync;
527 
528     uint32_t dc_crt_hwc_addr;
529     uint32_t dc_crt_hwc_location;
530     uint32_t dc_crt_hwc_color_1_2;
531     uint32_t dc_crt_hwc_color_3;
532 
533     uint32_t twoD_source;
534     uint32_t twoD_destination;
535     uint32_t twoD_dimension;
536     uint32_t twoD_control;
537     uint32_t twoD_pitch;
538     uint32_t twoD_foreground;
539     uint32_t twoD_background;
540     uint32_t twoD_stretch;
541     uint32_t twoD_color_compare;
542     uint32_t twoD_color_compare_mask;
543     uint32_t twoD_mask;
544     uint32_t twoD_clip_tl;
545     uint32_t twoD_clip_br;
546     uint32_t twoD_mono_pattern_low;
547     uint32_t twoD_mono_pattern_high;
548     uint32_t twoD_window_width;
549     uint32_t twoD_source_base;
550     uint32_t twoD_destination_base;
551     uint32_t twoD_alpha;
552     uint32_t twoD_wrap;
553 } SM501State;
554 
555 static uint32_t get_local_mem_size_index(uint32_t size)
556 {
557     uint32_t norm_size = 0;
558     int i, index = 0;
559 
560     for (i = 0; i < ARRAY_SIZE(sm501_mem_local_size); i++) {
561         uint32_t new_size = sm501_mem_local_size[i];
562         if (new_size >= size) {
563             if (norm_size == 0 || norm_size > new_size) {
564                 norm_size = new_size;
565                 index = i;
566             }
567         }
568     }
569 
570     return index;
571 }
572 
573 static ram_addr_t get_fb_addr(SM501State *s, int crt)
574 {
575     return (crt ? s->dc_crt_fb_addr : s->dc_panel_fb_addr) & 0x3FFFFF0;
576 }
577 
578 static inline int get_width(SM501State *s, int crt)
579 {
580     int width = crt ? s->dc_crt_h_total : s->dc_panel_h_total;
581     return (width & 0x00000FFF) + 1;
582 }
583 
584 static inline int get_height(SM501State *s, int crt)
585 {
586     int height = crt ? s->dc_crt_v_total : s->dc_panel_v_total;
587     return (height & 0x00000FFF) + 1;
588 }
589 
590 static inline int get_bpp(SM501State *s, int crt)
591 {
592     int bpp = crt ? s->dc_crt_control : s->dc_panel_control;
593     return 1 << (bpp & 3);
594 }
595 
596 /**
597  * Check the availability of hardware cursor.
598  * @param crt  0 for PANEL, 1 for CRT.
599  */
600 static inline int is_hwc_enabled(SM501State *state, int crt)
601 {
602     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
603     return addr & SM501_HWC_EN;
604 }
605 
606 /**
607  * Get the address which holds cursor pattern data.
608  * @param crt  0 for PANEL, 1 for CRT.
609  */
610 static inline uint8_t *get_hwc_address(SM501State *state, int crt)
611 {
612     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
613     return state->local_mem + (addr & 0x03FFFFF0);
614 }
615 
616 /**
617  * Get the cursor position in y coordinate.
618  * @param crt  0 for PANEL, 1 for CRT.
619  */
620 static inline uint32_t get_hwc_y(SM501State *state, int crt)
621 {
622     uint32_t location = crt ? state->dc_crt_hwc_location
623                             : state->dc_panel_hwc_location;
624     return (location & 0x07FF0000) >> 16;
625 }
626 
627 /**
628  * Get the cursor position in x coordinate.
629  * @param crt  0 for PANEL, 1 for CRT.
630  */
631 static inline uint32_t get_hwc_x(SM501State *state, int crt)
632 {
633     uint32_t location = crt ? state->dc_crt_hwc_location
634                             : state->dc_panel_hwc_location;
635     return location & 0x000007FF;
636 }
637 
638 /**
639  * Get the hardware cursor palette.
640  * @param crt  0 for PANEL, 1 for CRT.
641  * @param palette  pointer to a [3 * 3] array to store color values in
642  */
643 static inline void get_hwc_palette(SM501State *state, int crt, uint8_t *palette)
644 {
645     int i;
646     uint32_t color_reg;
647     uint16_t rgb565;
648 
649     for (i = 0; i < 3; i++) {
650         if (i + 1 == 3) {
651             color_reg = crt ? state->dc_crt_hwc_color_3
652                             : state->dc_panel_hwc_color_3;
653         } else {
654             color_reg = crt ? state->dc_crt_hwc_color_1_2
655                             : state->dc_panel_hwc_color_1_2;
656         }
657 
658         if (i + 1 == 2) {
659             rgb565 = (color_reg >> 16) & 0xFFFF;
660         } else {
661             rgb565 = color_reg & 0xFFFF;
662         }
663         palette[i * 3 + 0] = ((rgb565 >> 11) * 527 + 23) >> 6; /* r */
664         palette[i * 3 + 1] = (((rgb565 >> 5) & 0x3f) * 259 + 33) >> 6; /* g */
665         palette[i * 3 + 2] = ((rgb565 & 0x1f) * 527 + 23) >> 6; /* b */
666     }
667 }
668 
669 static inline void hwc_invalidate(SM501State *s, int crt)
670 {
671     int w = get_width(s, crt);
672     int h = get_height(s, crt);
673     int bpp = get_bpp(s, crt);
674     int start = get_hwc_y(s, crt);
675     int end = MIN(h, start + SM501_HWC_HEIGHT) + 1;
676 
677     start *= w * bpp;
678     end *= w * bpp;
679 
680     memory_region_set_dirty(&s->local_mem_region,
681                             get_fb_addr(s, crt) + start, end - start);
682 }
683 
684 static void sm501_2d_operation(SM501State *s)
685 {
686     int cmd = (s->twoD_control >> 16) & 0x1F;
687     int rtl = s->twoD_control & BIT(27);
688     int format = (s->twoD_stretch >> 20) & 3;
689     int bypp = 1 << format; /* bytes per pixel */
690     int rop_mode = (s->twoD_control >> 15) & 1; /* 1 for rop2, else rop3 */
691     /* 1 if rop2 source is the pattern, otherwise the source is the bitmap */
692     int rop2_source_is_pattern = (s->twoD_control >> 14) & 1;
693     int rop = s->twoD_control & 0xFF;
694     unsigned int dst_x = (s->twoD_destination >> 16) & 0x01FFF;
695     unsigned int dst_y = s->twoD_destination & 0xFFFF;
696     unsigned int width = (s->twoD_dimension >> 16) & 0x1FFF;
697     unsigned int height = s->twoD_dimension & 0xFFFF;
698     uint32_t dst_base = s->twoD_destination_base & 0x03FFFFFF;
699     unsigned int dst_pitch = (s->twoD_pitch >> 16) & 0x1FFF;
700     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
701     int fb_len = get_width(s, crt) * get_height(s, crt) * get_bpp(s, crt);
702     bool overlap = false, fallback = false;
703 
704     if ((s->twoD_stretch >> 16) & 0xF) {
705         qemu_log_mask(LOG_UNIMP, "sm501: only XY addressing is supported.\n");
706         return;
707     }
708 
709     if (s->twoD_source_base & BIT(27) || s->twoD_destination_base & BIT(27)) {
710         qemu_log_mask(LOG_UNIMP, "sm501: only local memory is supported.\n");
711         return;
712     }
713 
714     if (!dst_pitch) {
715         qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero dest pitch.\n");
716         return;
717     }
718 
719     if (!width || !height) {
720         qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero size 2D op.\n");
721         return;
722     }
723 
724     if (rtl) {
725         dst_x -= width - 1;
726         dst_y -= height - 1;
727     }
728 
729     if (dst_base >= get_local_mem_size(s) ||
730         dst_base + (dst_x + width + (dst_y + height) * dst_pitch) * bypp >=
731         get_local_mem_size(s)) {
732         qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
733         return;
734     }
735 
736     switch (cmd) {
737     case 0: /* BitBlt */
738     {
739         unsigned int src_x = (s->twoD_source >> 16) & 0x01FFF;
740         unsigned int src_y = s->twoD_source & 0xFFFF;
741         uint32_t src_base = s->twoD_source_base & 0x03FFFFFF;
742         unsigned int src_pitch = s->twoD_pitch & 0x1FFF;
743 
744         if (!src_pitch) {
745             qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero src pitch.\n");
746             return;
747         }
748 
749         if (rtl) {
750             src_x -= width - 1;
751             src_y -= height - 1;
752         }
753 
754         if (src_base >= get_local_mem_size(s) ||
755             src_base + (src_x + width + (src_y + height) * src_pitch) * bypp >=
756             get_local_mem_size(s)) {
757             qemu_log_mask(LOG_GUEST_ERROR,
758                           "sm501: 2D op src is outside vram.\n");
759             return;
760         }
761 
762         if ((rop_mode && rop == 0x5) || (!rop_mode && rop == 0x55)) {
763             /* DSTINVERT, is there a way to do this with pixman? */
764             unsigned int x, y, i;
765             uint8_t *d = s->local_mem + dst_base;
766 
767             for (y = 0; y < height; y++) {
768                 i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
769                 for (x = 0; x < width; x++, i += bypp) {
770                     stn_he_p(&d[i], bypp, ~ldn_he_p(&d[i], bypp));
771                 }
772             }
773         } else if (!rop_mode && rop == 0x99) {
774             /* DSxn, is there a way to do this with pixman? */
775             unsigned int x, y, i, j;
776             uint8_t *sp = s->local_mem + src_base;
777             uint8_t *d = s->local_mem + dst_base;
778 
779             for (y = 0; y < height; y++) {
780                 i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
781                 j = (src_x + (src_y + y) * src_pitch) * bypp;
782                 for (x = 0; x < width; x++, i += bypp, j += bypp) {
783                     stn_he_p(&d[i], bypp,
784                              ~(ldn_he_p(&sp[j], bypp) ^ ldn_he_p(&d[i], bypp)));
785                 }
786             }
787         } else if (!rop_mode && rop == 0xee) {
788             /* SRCPAINT, is there a way to do this with pixman? */
789             unsigned int x, y, i, j;
790             uint8_t *sp = s->local_mem + src_base;
791             uint8_t *d = s->local_mem + dst_base;
792 
793             for (y = 0; y < height; y++) {
794                 i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
795                 j = (src_x + (src_y + y) * src_pitch) * bypp;
796                 for (x = 0; x < width; x++, i += bypp, j += bypp) {
797                     stn_he_p(&d[i], bypp,
798                              ldn_he_p(&sp[j], bypp) | ldn_he_p(&d[i], bypp));
799                 }
800             }
801         } else {
802             /* Do copy src for unimplemented ops, better than unpainted area */
803             if ((rop_mode && (rop != 0xc || rop2_source_is_pattern)) ||
804                 (!rop_mode && rop != 0xcc)) {
805                 qemu_log_mask(LOG_UNIMP,
806                               "sm501: rop%d op %x%s not implemented\n",
807                               (rop_mode ? 2 : 3), rop,
808                               (rop2_source_is_pattern ?
809                                   " with pattern source" : ""));
810             }
811             /* Ignore no-op blits, some guests seem to do this */
812             if (src_base == dst_base && src_pitch == dst_pitch &&
813                 src_x == dst_x && src_y == dst_y) {
814                 break;
815             }
816             /* Some clients also do 1 pixel blits, avoid overhead for these */
817             if (width == 1 && height == 1) {
818                 unsigned int si = (src_x + src_y * src_pitch) * bypp;
819                 unsigned int di = (dst_x + dst_y * dst_pitch) * bypp;
820                 stn_he_p(&s->local_mem[dst_base + di], bypp,
821                          ldn_he_p(&s->local_mem[src_base + si], bypp));
822                 break;
823             }
824             /* If reverse blit do simple check for overlaps */
825             if (rtl && src_base == dst_base && src_pitch == dst_pitch) {
826                 overlap = (src_x < dst_x + width && src_x + width > dst_x &&
827                            src_y < dst_y + height && src_y + height > dst_y);
828             } else if (rtl) {
829                 unsigned int sb, se, db, de;
830                 sb = src_base + (src_x + src_y * src_pitch) * bypp;
831                 se = sb + (width + (height - 1) * src_pitch) * bypp;
832                 db = dst_base + (dst_x + dst_y * dst_pitch) * bypp;
833                 de = db + (width + (height - 1) * dst_pitch) * bypp;
834                 overlap = (db < se && sb < de);
835             }
836 #ifdef CONFIG_PIXMAN
837             if (overlap && (s->use_pixman & BIT(2))) {
838                 /* pixman can't do reverse blit: copy via temporary */
839                 int tmp_stride = DIV_ROUND_UP(width * bypp, sizeof(uint32_t));
840                 static uint32_t tmp_buf[16384];
841                 uint32_t *tmp = tmp_buf;
842 
843                 if (tmp_stride * sizeof(uint32_t) * height > sizeof(tmp_buf)) {
844                     tmp = g_malloc(tmp_stride * sizeof(uint32_t) * height);
845                 }
846                 fallback = !pixman_blt((uint32_t *)&s->local_mem[src_base],
847                                        tmp,
848                                        src_pitch * bypp / sizeof(uint32_t),
849                                        tmp_stride,
850                                        8 * bypp, 8 * bypp,
851                                        src_x, src_y, 0, 0, width, height);
852                 if (!fallback) {
853                     fallback = !pixman_blt(tmp,
854                                        (uint32_t *)&s->local_mem[dst_base],
855                                        tmp_stride,
856                                        dst_pitch * bypp / sizeof(uint32_t),
857                                        8 * bypp, 8 * bypp,
858                                        0, 0, dst_x, dst_y, width, height);
859                 }
860                 if (tmp != tmp_buf) {
861                     g_free(tmp);
862                 }
863             } else if (!overlap && (s->use_pixman & BIT(1))) {
864                 fallback = !pixman_blt((uint32_t *)&s->local_mem[src_base],
865                                        (uint32_t *)&s->local_mem[dst_base],
866                                        src_pitch * bypp / sizeof(uint32_t),
867                                        dst_pitch * bypp / sizeof(uint32_t),
868                                        8 * bypp, 8 * bypp, src_x, src_y,
869                                        dst_x, dst_y, width, height);
870             } else
871 #endif
872             {
873                 fallback = true;
874             }
875             if (fallback) {
876                 uint8_t *sp = s->local_mem + src_base;
877                 uint8_t *d = s->local_mem + dst_base;
878                 unsigned int y, i, j;
879                 for (y = 0; y < height; y++) {
880                     if (overlap) { /* overlap also means rtl */
881                         i = (dst_y + height - 1 - y) * dst_pitch;
882                         i = (dst_x + i) * bypp;
883                         j = (src_y + height - 1 - y) * src_pitch;
884                         j = (src_x + j) * bypp;
885                         memmove(&d[i], &sp[j], width * bypp);
886                     } else {
887                         i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
888                         j = (src_x + (src_y + y) * src_pitch) * bypp;
889                         memcpy(&d[i], &sp[j], width * bypp);
890                     }
891                 }
892             }
893         }
894         break;
895     }
896     case 1: /* Rectangle Fill */
897     {
898         uint32_t color = s->twoD_foreground;
899 
900         if (format == 2) {
901             color = cpu_to_le32(color);
902         } else if (format == 1) {
903             color = cpu_to_le16(color);
904         }
905 
906 #ifdef CONFIG_PIXMAN
907         if (!(s->use_pixman & BIT(0)) || (width == 1 && height == 1) ||
908             !pixman_fill((uint32_t *)&s->local_mem[dst_base],
909                          dst_pitch * bypp / sizeof(uint32_t), 8 * bypp,
910                          dst_x, dst_y, width, height, color))
911 #endif
912             {
913                 /* fallback when pixman failed or we don't want to call it */
914                 uint8_t *d = s->local_mem + dst_base;
915                 unsigned int x, y, i;
916                 for (y = 0; y < height; y++) {
917                     i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
918                     for (x = 0; x < width; x++, i += bypp) {
919                         stn_he_p(&d[i], bypp, color);
920                     }
921                 }
922             }
923         break;
924     }
925     default:
926         qemu_log_mask(LOG_UNIMP, "sm501: not implemented 2D operation: %d\n",
927                       cmd);
928         return;
929     }
930 
931     if (dst_base >= get_fb_addr(s, crt) &&
932         dst_base <= get_fb_addr(s, crt) + fb_len) {
933         int dst_len = MIN(fb_len, ((dst_y + height - 1) * dst_pitch +
934                           dst_x + width) * bypp);
935         if (dst_len) {
936             memory_region_set_dirty(&s->local_mem_region, dst_base, dst_len);
937         }
938     }
939 }
940 
941 static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
942                                          unsigned size)
943 {
944     SM501State *s = opaque;
945     uint32_t ret = 0;
946 
947     switch (addr) {
948     case SM501_SYSTEM_CONTROL:
949         ret = s->system_control;
950         break;
951     case SM501_MISC_CONTROL:
952         ret = s->misc_control;
953         break;
954     case SM501_GPIO31_0_CONTROL:
955         ret = s->gpio_31_0_control;
956         break;
957     case SM501_GPIO63_32_CONTROL:
958         ret = s->gpio_63_32_control;
959         break;
960     case SM501_DEVICEID:
961         ret = 0x050100A0;
962         break;
963     case SM501_DRAM_CONTROL:
964         ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
965         break;
966     case SM501_ARBTRTN_CONTROL:
967         ret = s->arbitration_control;
968         break;
969     case SM501_COMMAND_LIST_STATUS:
970         ret = 0x00180002; /* FIFOs are empty, everything idle */
971         break;
972     case SM501_IRQ_MASK:
973         ret = s->irq_mask;
974         break;
975     case SM501_MISC_TIMING:
976         /* TODO : simulate gate control */
977         ret = s->misc_timing;
978         break;
979     case SM501_CURRENT_GATE:
980         /* TODO : simulate gate control */
981         ret = 0x00021807;
982         break;
983     case SM501_CURRENT_CLOCK:
984         ret = 0x2A1A0A09;
985         break;
986     case SM501_POWER_MODE_CONTROL:
987         ret = s->power_mode_control;
988         break;
989     case SM501_ENDIAN_CONTROL:
990         ret = 0; /* Only default little endian mode is supported */
991         break;
992 
993     default:
994         qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
995                       "register read. addr=%" HWADDR_PRIx "\n", addr);
996     }
997     trace_sm501_system_config_read(addr, ret);
998     return ret;
999 }
1000 
1001 static void sm501_system_config_write(void *opaque, hwaddr addr,
1002                                       uint64_t value, unsigned size)
1003 {
1004     SM501State *s = opaque;
1005 
1006     trace_sm501_system_config_write((uint32_t)addr, (uint32_t)value);
1007     switch (addr) {
1008     case SM501_SYSTEM_CONTROL:
1009         s->system_control &= 0x10DB0000;
1010         s->system_control |= value & 0xEF00B8F7;
1011         break;
1012     case SM501_MISC_CONTROL:
1013         s->misc_control &= 0xEF;
1014         s->misc_control |= value & 0xFF7FFF10;
1015         break;
1016     case SM501_GPIO31_0_CONTROL:
1017         s->gpio_31_0_control = value;
1018         break;
1019     case SM501_GPIO63_32_CONTROL:
1020         s->gpio_63_32_control = value & 0xFF80FFFF;
1021         break;
1022     case SM501_DRAM_CONTROL:
1023         s->local_mem_size_index = (value >> 13) & 0x7;
1024         /* TODO : check validity of size change */
1025         s->dram_control &= 0x80000000;
1026         s->dram_control |= value & 0x7FFFFFC3;
1027         break;
1028     case SM501_ARBTRTN_CONTROL:
1029         s->arbitration_control = value & 0x37777777;
1030         break;
1031     case SM501_IRQ_MASK:
1032         s->irq_mask = value & 0xFFDF3F5F;
1033         break;
1034     case SM501_MISC_TIMING:
1035         s->misc_timing = value & 0xF31F1FFF;
1036         break;
1037     case SM501_POWER_MODE_0_GATE:
1038     case SM501_POWER_MODE_1_GATE:
1039     case SM501_POWER_MODE_0_CLOCK:
1040     case SM501_POWER_MODE_1_CLOCK:
1041         /* TODO : simulate gate & clock control */
1042         break;
1043     case SM501_POWER_MODE_CONTROL:
1044         s->power_mode_control = value & 0x00000003;
1045         break;
1046     case SM501_ENDIAN_CONTROL:
1047         if (value & 0x00000001) {
1048             qemu_log_mask(LOG_UNIMP, "sm501: system config big endian mode not"
1049                           " implemented.\n");
1050         }
1051         break;
1052 
1053     default:
1054         qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
1055                       "register write. addr=%" HWADDR_PRIx
1056                       ", val=%" PRIx64 "\n", addr, value);
1057     }
1058 }
1059 
1060 static const MemoryRegionOps sm501_system_config_ops = {
1061     .read = sm501_system_config_read,
1062     .write = sm501_system_config_write,
1063     .valid = {
1064         .min_access_size = 4,
1065         .max_access_size = 4,
1066     },
1067     .endianness = DEVICE_LITTLE_ENDIAN,
1068 };
1069 
1070 static uint64_t sm501_i2c_read(void *opaque, hwaddr addr, unsigned size)
1071 {
1072     SM501State *s = opaque;
1073     uint8_t ret = 0;
1074 
1075     switch (addr) {
1076     case SM501_I2C_BYTE_COUNT:
1077         ret = s->i2c_byte_count;
1078         break;
1079     case SM501_I2C_STATUS:
1080         ret = s->i2c_status;
1081         break;
1082     case SM501_I2C_SLAVE_ADDRESS:
1083         ret = s->i2c_addr;
1084         break;
1085     case SM501_I2C_DATA ... SM501_I2C_DATA + 15:
1086         ret = s->i2c_data[addr - SM501_I2C_DATA];
1087         break;
1088     default:
1089         qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register read."
1090                       " addr=0x%" HWADDR_PRIx "\n", addr);
1091     }
1092     trace_sm501_i2c_read((uint32_t)addr, ret);
1093     return ret;
1094 }
1095 
1096 static void sm501_i2c_write(void *opaque, hwaddr addr, uint64_t value,
1097                             unsigned size)
1098 {
1099     SM501State *s = opaque;
1100 
1101     trace_sm501_i2c_write((uint32_t)addr, (uint32_t)value);
1102     switch (addr) {
1103     case SM501_I2C_BYTE_COUNT:
1104         s->i2c_byte_count = value & 0xf;
1105         break;
1106     case SM501_I2C_CONTROL:
1107         if (value & SM501_I2C_CONTROL_ENABLE) {
1108             if (value & SM501_I2C_CONTROL_START) {
1109                 bool is_recv = s->i2c_addr & 1;
1110                 int res = i2c_start_transfer(s->i2c_bus,
1111                                              s->i2c_addr >> 1,
1112                                              is_recv);
1113                 if (res) {
1114                     s->i2c_status |= SM501_I2C_STATUS_ERROR;
1115                 } else {
1116                     int i;
1117                     for (i = 0; i <= s->i2c_byte_count; i++) {
1118                         if (is_recv) {
1119                             s->i2c_data[i] = i2c_recv(s->i2c_bus);
1120                         } else if (i2c_send(s->i2c_bus, s->i2c_data[i]) < 0) {
1121                             s->i2c_status |= SM501_I2C_STATUS_ERROR;
1122                             return;
1123                         }
1124                     }
1125                     if (i) {
1126                         s->i2c_status = SM501_I2C_STATUS_COMPLETE;
1127                     }
1128                 }
1129             } else {
1130                 i2c_end_transfer(s->i2c_bus);
1131                 s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
1132             }
1133         }
1134         break;
1135     case SM501_I2C_RESET:
1136         if ((value & SM501_I2C_RESET_ERROR) == 0) {
1137             s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
1138         }
1139         break;
1140     case SM501_I2C_SLAVE_ADDRESS:
1141         s->i2c_addr = value & 0xff;
1142         break;
1143     case SM501_I2C_DATA ... SM501_I2C_DATA + 15:
1144         s->i2c_data[addr - SM501_I2C_DATA] = value & 0xff;
1145         break;
1146     default:
1147         qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register write. "
1148                       "addr=0x%" HWADDR_PRIx " val=%" PRIx64 "\n", addr, value);
1149     }
1150 }
1151 
1152 static const MemoryRegionOps sm501_i2c_ops = {
1153     .read = sm501_i2c_read,
1154     .write = sm501_i2c_write,
1155     .valid = {
1156         .min_access_size = 1,
1157         .max_access_size = 1,
1158     },
1159     .impl = {
1160         .min_access_size = 1,
1161         .max_access_size = 1,
1162     },
1163     .endianness = DEVICE_LITTLE_ENDIAN,
1164 };
1165 
1166 static uint32_t sm501_palette_read(void *opaque, hwaddr addr)
1167 {
1168     SM501State *s = opaque;
1169 
1170     trace_sm501_palette_read((uint32_t)addr);
1171 
1172     /* TODO : consider BYTE/WORD access */
1173     /* TODO : consider endian */
1174 
1175     assert(range_covers_byte(0, 0x400 * 3, addr));
1176     return *(uint32_t *)&s->dc_palette[addr];
1177 }
1178 
1179 static void sm501_palette_write(void *opaque, hwaddr addr,
1180                                 uint32_t value)
1181 {
1182     SM501State *s = opaque;
1183 
1184     trace_sm501_palette_write((uint32_t)addr, value);
1185 
1186     /* TODO : consider BYTE/WORD access */
1187     /* TODO : consider endian */
1188 
1189     assert(range_covers_byte(0, 0x400 * 3, addr));
1190     *(uint32_t *)&s->dc_palette[addr] = value;
1191     s->do_full_update = true;
1192 }
1193 
1194 static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr addr,
1195                                      unsigned size)
1196 {
1197     SM501State *s = opaque;
1198     uint32_t ret = 0;
1199 
1200     switch (addr) {
1201 
1202     case SM501_DC_PANEL_CONTROL:
1203         ret = s->dc_panel_control;
1204         break;
1205     case SM501_DC_PANEL_PANNING_CONTROL:
1206         ret = s->dc_panel_panning_control;
1207         break;
1208     case SM501_DC_PANEL_COLOR_KEY:
1209         /* Not implemented yet */
1210         break;
1211     case SM501_DC_PANEL_FB_ADDR:
1212         ret = s->dc_panel_fb_addr;
1213         break;
1214     case SM501_DC_PANEL_FB_OFFSET:
1215         ret = s->dc_panel_fb_offset;
1216         break;
1217     case SM501_DC_PANEL_FB_WIDTH:
1218         ret = s->dc_panel_fb_width;
1219         break;
1220     case SM501_DC_PANEL_FB_HEIGHT:
1221         ret = s->dc_panel_fb_height;
1222         break;
1223     case SM501_DC_PANEL_TL_LOC:
1224         ret = s->dc_panel_tl_location;
1225         break;
1226     case SM501_DC_PANEL_BR_LOC:
1227         ret = s->dc_panel_br_location;
1228         break;
1229 
1230     case SM501_DC_PANEL_H_TOT:
1231         ret = s->dc_panel_h_total;
1232         break;
1233     case SM501_DC_PANEL_H_SYNC:
1234         ret = s->dc_panel_h_sync;
1235         break;
1236     case SM501_DC_PANEL_V_TOT:
1237         ret = s->dc_panel_v_total;
1238         break;
1239     case SM501_DC_PANEL_V_SYNC:
1240         ret = s->dc_panel_v_sync;
1241         break;
1242 
1243     case SM501_DC_PANEL_HWC_ADDR:
1244         ret = s->dc_panel_hwc_addr;
1245         break;
1246     case SM501_DC_PANEL_HWC_LOC:
1247         ret = s->dc_panel_hwc_location;
1248         break;
1249     case SM501_DC_PANEL_HWC_COLOR_1_2:
1250         ret = s->dc_panel_hwc_color_1_2;
1251         break;
1252     case SM501_DC_PANEL_HWC_COLOR_3:
1253         ret = s->dc_panel_hwc_color_3;
1254         break;
1255 
1256     case SM501_DC_VIDEO_CONTROL:
1257         ret = s->dc_video_control;
1258         break;
1259 
1260     case SM501_DC_CRT_CONTROL:
1261         ret = s->dc_crt_control;
1262         break;
1263     case SM501_DC_CRT_FB_ADDR:
1264         ret = s->dc_crt_fb_addr;
1265         break;
1266     case SM501_DC_CRT_FB_OFFSET:
1267         ret = s->dc_crt_fb_offset;
1268         break;
1269     case SM501_DC_CRT_H_TOT:
1270         ret = s->dc_crt_h_total;
1271         break;
1272     case SM501_DC_CRT_H_SYNC:
1273         ret = s->dc_crt_h_sync;
1274         break;
1275     case SM501_DC_CRT_V_TOT:
1276         ret = s->dc_crt_v_total;
1277         break;
1278     case SM501_DC_CRT_V_SYNC:
1279         ret = s->dc_crt_v_sync;
1280         break;
1281 
1282     case SM501_DC_CRT_HWC_ADDR:
1283         ret = s->dc_crt_hwc_addr;
1284         break;
1285     case SM501_DC_CRT_HWC_LOC:
1286         ret = s->dc_crt_hwc_location;
1287         break;
1288     case SM501_DC_CRT_HWC_COLOR_1_2:
1289         ret = s->dc_crt_hwc_color_1_2;
1290         break;
1291     case SM501_DC_CRT_HWC_COLOR_3:
1292         ret = s->dc_crt_hwc_color_3;
1293         break;
1294 
1295     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1296         ret = sm501_palette_read(opaque, addr - SM501_DC_PANEL_PALETTE);
1297         break;
1298 
1299     default:
1300         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1301                       "read. addr=%" HWADDR_PRIx "\n", addr);
1302     }
1303     trace_sm501_disp_ctrl_read((uint32_t)addr, ret);
1304     return ret;
1305 }
1306 
1307 static void sm501_disp_ctrl_write(void *opaque, hwaddr addr,
1308                                   uint64_t value, unsigned size)
1309 {
1310     SM501State *s = opaque;
1311 
1312     trace_sm501_disp_ctrl_write((uint32_t)addr, (uint32_t)value);
1313     switch (addr) {
1314     case SM501_DC_PANEL_CONTROL:
1315         s->dc_panel_control = value & 0x0FFF73FF;
1316         break;
1317     case SM501_DC_PANEL_PANNING_CONTROL:
1318         s->dc_panel_panning_control = value & 0xFF3FFF3F;
1319         break;
1320     case SM501_DC_PANEL_COLOR_KEY:
1321         /* Not implemented yet */
1322         break;
1323     case SM501_DC_PANEL_FB_ADDR:
1324         s->dc_panel_fb_addr = value & 0x8FFFFFF0;
1325         if (value & 0x8000000) {
1326             qemu_log_mask(LOG_UNIMP, "Panel external memory not supported\n");
1327         }
1328         s->do_full_update = true;
1329         break;
1330     case SM501_DC_PANEL_FB_OFFSET:
1331         s->dc_panel_fb_offset = value & 0x3FF03FF0;
1332         break;
1333     case SM501_DC_PANEL_FB_WIDTH:
1334         s->dc_panel_fb_width = value & 0x0FFF0FFF;
1335         break;
1336     case SM501_DC_PANEL_FB_HEIGHT:
1337         s->dc_panel_fb_height = value & 0x0FFF0FFF;
1338         break;
1339     case SM501_DC_PANEL_TL_LOC:
1340         s->dc_panel_tl_location = value & 0x07FF07FF;
1341         break;
1342     case SM501_DC_PANEL_BR_LOC:
1343         s->dc_panel_br_location = value & 0x07FF07FF;
1344         break;
1345 
1346     case SM501_DC_PANEL_H_TOT:
1347         s->dc_panel_h_total = value & 0x0FFF0FFF;
1348         break;
1349     case SM501_DC_PANEL_H_SYNC:
1350         s->dc_panel_h_sync = value & 0x00FF0FFF;
1351         break;
1352     case SM501_DC_PANEL_V_TOT:
1353         s->dc_panel_v_total = value & 0x0FFF0FFF;
1354         break;
1355     case SM501_DC_PANEL_V_SYNC:
1356         s->dc_panel_v_sync = value & 0x003F0FFF;
1357         break;
1358 
1359     case SM501_DC_PANEL_HWC_ADDR:
1360         value &= 0x8FFFFFF0;
1361         if (value != s->dc_panel_hwc_addr) {
1362             hwc_invalidate(s, 0);
1363             s->dc_panel_hwc_addr = value;
1364         }
1365         break;
1366     case SM501_DC_PANEL_HWC_LOC:
1367         value &= 0x0FFF0FFF;
1368         if (value != s->dc_panel_hwc_location) {
1369             hwc_invalidate(s, 0);
1370             s->dc_panel_hwc_location = value;
1371         }
1372         break;
1373     case SM501_DC_PANEL_HWC_COLOR_1_2:
1374         s->dc_panel_hwc_color_1_2 = value;
1375         break;
1376     case SM501_DC_PANEL_HWC_COLOR_3:
1377         s->dc_panel_hwc_color_3 = value & 0x0000FFFF;
1378         break;
1379 
1380     case SM501_DC_VIDEO_CONTROL:
1381         s->dc_video_control = value & 0x00037FFF;
1382         break;
1383 
1384     case SM501_DC_CRT_CONTROL:
1385         s->dc_crt_control = value & 0x0003FFFF;
1386         break;
1387     case SM501_DC_CRT_FB_ADDR:
1388         s->dc_crt_fb_addr = value & 0x8FFFFFF0;
1389         if (value & 0x8000000) {
1390             qemu_log_mask(LOG_UNIMP, "CRT external memory not supported\n");
1391         }
1392         s->do_full_update = true;
1393         break;
1394     case SM501_DC_CRT_FB_OFFSET:
1395         s->dc_crt_fb_offset = value & 0x3FF03FF0;
1396         break;
1397     case SM501_DC_CRT_H_TOT:
1398         s->dc_crt_h_total = value & 0x0FFF0FFF;
1399         break;
1400     case SM501_DC_CRT_H_SYNC:
1401         s->dc_crt_h_sync = value & 0x00FF0FFF;
1402         break;
1403     case SM501_DC_CRT_V_TOT:
1404         s->dc_crt_v_total = value & 0x0FFF0FFF;
1405         break;
1406     case SM501_DC_CRT_V_SYNC:
1407         s->dc_crt_v_sync = value & 0x003F0FFF;
1408         break;
1409 
1410     case SM501_DC_CRT_HWC_ADDR:
1411         value &= 0x8FFFFFF0;
1412         if (value != s->dc_crt_hwc_addr) {
1413             hwc_invalidate(s, 1);
1414             s->dc_crt_hwc_addr = value;
1415         }
1416         break;
1417     case SM501_DC_CRT_HWC_LOC:
1418         value &= 0x0FFF0FFF;
1419         if (value != s->dc_crt_hwc_location) {
1420             hwc_invalidate(s, 1);
1421             s->dc_crt_hwc_location = value;
1422         }
1423         break;
1424     case SM501_DC_CRT_HWC_COLOR_1_2:
1425         s->dc_crt_hwc_color_1_2 = value;
1426         break;
1427     case SM501_DC_CRT_HWC_COLOR_3:
1428         s->dc_crt_hwc_color_3 = value & 0x0000FFFF;
1429         break;
1430 
1431     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1432         sm501_palette_write(opaque, addr - SM501_DC_PANEL_PALETTE, value);
1433         break;
1434 
1435     default:
1436         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1437                       "write. addr=%" HWADDR_PRIx
1438                       ", val=%" PRIx64 "\n", addr, value);
1439     }
1440 }
1441 
1442 static const MemoryRegionOps sm501_disp_ctrl_ops = {
1443     .read = sm501_disp_ctrl_read,
1444     .write = sm501_disp_ctrl_write,
1445     .valid = {
1446         .min_access_size = 4,
1447         .max_access_size = 4,
1448     },
1449     .endianness = DEVICE_LITTLE_ENDIAN,
1450 };
1451 
1452 static uint64_t sm501_2d_engine_read(void *opaque, hwaddr addr,
1453                                      unsigned size)
1454 {
1455     SM501State *s = opaque;
1456     uint32_t ret = 0;
1457 
1458     switch (addr) {
1459     case SM501_2D_SOURCE:
1460         ret = s->twoD_source;
1461         break;
1462     case SM501_2D_DESTINATION:
1463         ret = s->twoD_destination;
1464         break;
1465     case SM501_2D_DIMENSION:
1466         ret = s->twoD_dimension;
1467         break;
1468     case SM501_2D_CONTROL:
1469         ret = s->twoD_control;
1470         break;
1471     case SM501_2D_PITCH:
1472         ret = s->twoD_pitch;
1473         break;
1474     case SM501_2D_FOREGROUND:
1475         ret = s->twoD_foreground;
1476         break;
1477     case SM501_2D_BACKGROUND:
1478         ret = s->twoD_background;
1479         break;
1480     case SM501_2D_STRETCH:
1481         ret = s->twoD_stretch;
1482         break;
1483     case SM501_2D_COLOR_COMPARE:
1484         ret = s->twoD_color_compare;
1485         break;
1486     case SM501_2D_COLOR_COMPARE_MASK:
1487         ret = s->twoD_color_compare_mask;
1488         break;
1489     case SM501_2D_MASK:
1490         ret = s->twoD_mask;
1491         break;
1492     case SM501_2D_CLIP_TL:
1493         ret = s->twoD_clip_tl;
1494         break;
1495     case SM501_2D_CLIP_BR:
1496         ret = s->twoD_clip_br;
1497         break;
1498     case SM501_2D_MONO_PATTERN_LOW:
1499         ret = s->twoD_mono_pattern_low;
1500         break;
1501     case SM501_2D_MONO_PATTERN_HIGH:
1502         ret = s->twoD_mono_pattern_high;
1503         break;
1504     case SM501_2D_WINDOW_WIDTH:
1505         ret = s->twoD_window_width;
1506         break;
1507     case SM501_2D_SOURCE_BASE:
1508         ret = s->twoD_source_base;
1509         break;
1510     case SM501_2D_DESTINATION_BASE:
1511         ret = s->twoD_destination_base;
1512         break;
1513     case SM501_2D_ALPHA:
1514         ret = s->twoD_alpha;
1515         break;
1516     case SM501_2D_WRAP:
1517         ret = s->twoD_wrap;
1518         break;
1519     case SM501_2D_STATUS:
1520         ret = 0; /* Should return interrupt status */
1521         break;
1522     default:
1523         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1524                       "read. addr=%" HWADDR_PRIx "\n", addr);
1525     }
1526     trace_sm501_2d_engine_read((uint32_t)addr, ret);
1527     return ret;
1528 }
1529 
1530 static void sm501_2d_engine_write(void *opaque, hwaddr addr,
1531                                   uint64_t value, unsigned size)
1532 {
1533     SM501State *s = opaque;
1534 
1535     trace_sm501_2d_engine_write((uint32_t)addr, (uint32_t)value);
1536     switch (addr) {
1537     case SM501_2D_SOURCE:
1538         s->twoD_source = value;
1539         break;
1540     case SM501_2D_DESTINATION:
1541         s->twoD_destination = value;
1542         break;
1543     case SM501_2D_DIMENSION:
1544         s->twoD_dimension = value;
1545         break;
1546     case SM501_2D_CONTROL:
1547         s->twoD_control = value;
1548 
1549         /* do 2d operation if start flag is set. */
1550         if (value & 0x80000000) {
1551             sm501_2d_operation(s);
1552             s->twoD_control &= ~0x80000000; /* start flag down */
1553         }
1554 
1555         break;
1556     case SM501_2D_PITCH:
1557         s->twoD_pitch = value;
1558         break;
1559     case SM501_2D_FOREGROUND:
1560         s->twoD_foreground = value;
1561         break;
1562     case SM501_2D_BACKGROUND:
1563         s->twoD_background = value;
1564         break;
1565     case SM501_2D_STRETCH:
1566         if (((value >> 20) & 3) == 3) {
1567             value &= ~BIT(20);
1568         }
1569         s->twoD_stretch = value;
1570         break;
1571     case SM501_2D_COLOR_COMPARE:
1572         s->twoD_color_compare = value;
1573         break;
1574     case SM501_2D_COLOR_COMPARE_MASK:
1575         s->twoD_color_compare_mask = value;
1576         break;
1577     case SM501_2D_MASK:
1578         s->twoD_mask = value;
1579         break;
1580     case SM501_2D_CLIP_TL:
1581         s->twoD_clip_tl = value;
1582         break;
1583     case SM501_2D_CLIP_BR:
1584         s->twoD_clip_br = value;
1585         break;
1586     case SM501_2D_MONO_PATTERN_LOW:
1587         s->twoD_mono_pattern_low = value;
1588         break;
1589     case SM501_2D_MONO_PATTERN_HIGH:
1590         s->twoD_mono_pattern_high = value;
1591         break;
1592     case SM501_2D_WINDOW_WIDTH:
1593         s->twoD_window_width = value;
1594         break;
1595     case SM501_2D_SOURCE_BASE:
1596         s->twoD_source_base = value;
1597         break;
1598     case SM501_2D_DESTINATION_BASE:
1599         s->twoD_destination_base = value;
1600         break;
1601     case SM501_2D_ALPHA:
1602         s->twoD_alpha = value;
1603         break;
1604     case SM501_2D_WRAP:
1605         s->twoD_wrap = value;
1606         break;
1607     case SM501_2D_STATUS:
1608         /* ignored, writing 0 should clear interrupt status */
1609         break;
1610     default:
1611         qemu_log_mask(LOG_UNIMP, "sm501: not implemented 2d engine register "
1612                       "write. addr=%" HWADDR_PRIx
1613                       ", val=%" PRIx64 "\n", addr, value);
1614     }
1615 }
1616 
1617 static const MemoryRegionOps sm501_2d_engine_ops = {
1618     .read = sm501_2d_engine_read,
1619     .write = sm501_2d_engine_write,
1620     .valid = {
1621         .min_access_size = 4,
1622         .max_access_size = 4,
1623     },
1624     .endianness = DEVICE_LITTLE_ENDIAN,
1625 };
1626 
1627 /* draw line functions for all console modes */
1628 
1629 typedef void draw_line_func(uint8_t *d, const uint8_t *s,
1630                             int width, const uint32_t *pal);
1631 
1632 typedef void draw_hwc_line_func(uint8_t *d, const uint8_t *s,
1633                                 int width, const uint8_t *palette,
1634                                 int c_x, int c_y);
1635 
1636 static void draw_line8_32(uint8_t *d, const uint8_t *s, int width,
1637                           const uint32_t *pal)
1638 {
1639     uint8_t v, r, g, b;
1640     do {
1641         v = ldub_p(s);
1642         r = (pal[v] >> 16) & 0xff;
1643         g = (pal[v] >>  8) & 0xff;
1644         b = (pal[v] >>  0) & 0xff;
1645         *(uint32_t *)d = rgb_to_pixel32(r, g, b);
1646         s++;
1647         d += 4;
1648     } while (--width != 0);
1649 }
1650 
1651 static void draw_line16_32(uint8_t *d, const uint8_t *s, int width,
1652                            const uint32_t *pal)
1653 {
1654     uint16_t rgb565;
1655     uint8_t r, g, b;
1656 
1657     do {
1658         rgb565 = lduw_le_p(s);
1659         r = (rgb565 >> 8) & 0xf8;
1660         g = (rgb565 >> 3) & 0xfc;
1661         b = (rgb565 << 3) & 0xf8;
1662         *(uint32_t *)d = rgb_to_pixel32(r, g, b);
1663         s += 2;
1664         d += 4;
1665     } while (--width != 0);
1666 }
1667 
1668 static void draw_line32_32(uint8_t *d, const uint8_t *s, int width,
1669                            const uint32_t *pal)
1670 {
1671     uint8_t r, g, b;
1672 
1673     do {
1674         r = s[2];
1675         g = s[1];
1676         b = s[0];
1677         *(uint32_t *)d = rgb_to_pixel32(r, g, b);
1678         s += 4;
1679         d += 4;
1680     } while (--width != 0);
1681 }
1682 
1683 /**
1684  * Draw hardware cursor image on the given line.
1685  */
1686 static void draw_hwc_line_32(uint8_t *d, const uint8_t *s, int width,
1687                              const uint8_t *palette, int c_x, int c_y)
1688 {
1689     int i;
1690     uint8_t r, g, b, v, bitset = 0;
1691 
1692     /* get cursor position */
1693     assert(0 <= c_y && c_y < SM501_HWC_HEIGHT);
1694     s += SM501_HWC_WIDTH * c_y / 4;  /* 4 pixels per byte */
1695     d += c_x * 4;
1696 
1697     for (i = 0; i < SM501_HWC_WIDTH && c_x + i < width; i++) {
1698         /* get pixel value */
1699         if (i % 4 == 0) {
1700             bitset = ldub_p(s);
1701             s++;
1702         }
1703         v = bitset & 3;
1704         bitset >>= 2;
1705 
1706         /* write pixel */
1707         if (v) {
1708             v--;
1709             r = palette[v * 3 + 0];
1710             g = palette[v * 3 + 1];
1711             b = palette[v * 3 + 2];
1712             *(uint32_t *)d = rgb_to_pixel32(r, g, b);
1713         }
1714         d += 4;
1715     }
1716 }
1717 
1718 static void sm501_update_display(void *opaque)
1719 {
1720     SM501State *s = opaque;
1721     DisplaySurface *surface = qemu_console_surface(s->con);
1722     DirtyBitmapSnapshot *snap;
1723     int y, c_x = 0, c_y = 0;
1724     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
1725     int width = get_width(s, crt);
1726     int height = get_height(s, crt);
1727     int src_bpp = get_bpp(s, crt);
1728     int dst_bpp = surface_bytes_per_pixel(surface);
1729     draw_line_func *draw_line = NULL;
1730     draw_hwc_line_func *draw_hwc_line = NULL;
1731     int full_update = 0;
1732     int y_start = -1;
1733     ram_addr_t offset;
1734     uint32_t *palette;
1735     uint8_t hwc_palette[3 * 3];
1736     uint8_t *hwc_src = NULL;
1737 
1738     assert(dst_bpp == 4); /* Output is always 32-bit RGB */
1739 
1740     if (!((crt ? s->dc_crt_control : s->dc_panel_control)
1741           & SM501_DC_CRT_CONTROL_ENABLE)) {
1742         return;
1743     }
1744 
1745     palette = (uint32_t *)(crt ? &s->dc_palette[SM501_DC_CRT_PALETTE -
1746                                                 SM501_DC_PANEL_PALETTE]
1747                                : &s->dc_palette[0]);
1748 
1749     /* choose draw_line function */
1750     switch (src_bpp) {
1751     case 1:
1752         draw_line = draw_line8_32;
1753         break;
1754     case 2:
1755         draw_line = draw_line16_32;
1756         break;
1757     case 4:
1758         draw_line = draw_line32_32;
1759         break;
1760     default:
1761         qemu_log_mask(LOG_GUEST_ERROR, "sm501: update display"
1762                       "invalid control register value.\n");
1763         return;
1764     }
1765 
1766     /* set up to draw hardware cursor */
1767     if (is_hwc_enabled(s, crt)) {
1768         /* choose cursor draw line function */
1769         draw_hwc_line = draw_hwc_line_32;
1770         hwc_src = get_hwc_address(s, crt);
1771         c_x = get_hwc_x(s, crt);
1772         c_y = get_hwc_y(s, crt);
1773         get_hwc_palette(s, crt, hwc_palette);
1774     }
1775 
1776     /* adjust console size */
1777     if (s->last_width != width || s->last_height != height) {
1778         qemu_console_resize(s->con, width, height);
1779         surface = qemu_console_surface(s->con);
1780         s->last_width = width;
1781         s->last_height = height;
1782         full_update = 1;
1783     }
1784 
1785     /* someone else requested a full update */
1786     if (s->do_full_update) {
1787         s->do_full_update = false;
1788         full_update = 1;
1789     }
1790 
1791     /* draw each line according to conditions */
1792     offset = get_fb_addr(s, crt);
1793     snap = memory_region_snapshot_and_clear_dirty(&s->local_mem_region,
1794               offset, width * height * src_bpp, DIRTY_MEMORY_VGA);
1795     for (y = 0; y < height; y++, offset += width * src_bpp) {
1796         int update, update_hwc;
1797 
1798         /* check if hardware cursor is enabled and we're within its range */
1799         update_hwc = draw_hwc_line && c_y <= y && y < c_y + SM501_HWC_HEIGHT;
1800         update = full_update || update_hwc;
1801         /* check dirty flags for each line */
1802         update |= memory_region_snapshot_get_dirty(&s->local_mem_region, snap,
1803                                                    offset, width * src_bpp);
1804 
1805         /* draw line and change status */
1806         if (update) {
1807             uint8_t *d = surface_data(surface);
1808             d +=  y * width * dst_bpp;
1809 
1810             /* draw graphics layer */
1811             draw_line(d, s->local_mem + offset, width, palette);
1812 
1813             /* draw hardware cursor */
1814             if (update_hwc) {
1815                 draw_hwc_line(d, hwc_src, width, hwc_palette, c_x, y - c_y);
1816             }
1817 
1818             if (y_start < 0) {
1819                 y_start = y;
1820             }
1821         } else {
1822             if (y_start >= 0) {
1823                 /* flush to display */
1824                 dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1825                 y_start = -1;
1826             }
1827         }
1828     }
1829     g_free(snap);
1830 
1831     /* complete flush to display */
1832     if (y_start >= 0) {
1833         dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1834     }
1835 }
1836 
1837 static const GraphicHwOps sm501_ops = {
1838     .gfx_update  = sm501_update_display,
1839 };
1840 
1841 static void sm501_reset(SM501State *s)
1842 {
1843     s->system_control = 0x00100000; /* 2D engine FIFO empty */
1844     /*
1845      * Bits 17 (SH), 7 (CDR), 6:5 (Test), 2:0 (Bus) are all supposed
1846      * to be determined at reset by GPIO lines which set config bits.
1847      * We hardwire them:
1848      *  SH = 0 : Hitachi Ready Polarity == Active Low
1849      *  CDR = 0 : do not reset clock divider
1850      *  TEST = 0 : Normal mode (not testing the silicon)
1851      *  BUS = 0 : Hitachi SH3/SH4
1852      */
1853     s->misc_control = SM501_MISC_DAC_POWER;
1854     s->gpio_31_0_control = 0;
1855     s->gpio_63_32_control = 0;
1856     s->dram_control = 0;
1857     s->arbitration_control = 0x05146732;
1858     s->irq_mask = 0;
1859     s->misc_timing = 0;
1860     s->power_mode_control = 0;
1861     s->i2c_byte_count = 0;
1862     s->i2c_status = 0;
1863     s->i2c_addr = 0;
1864     memset(s->i2c_data, 0, 16);
1865     s->dc_panel_control = 0x00010000; /* FIFO level 3 */
1866     s->dc_video_control = 0;
1867     s->dc_crt_control = 0x00010000;
1868     s->twoD_source = 0;
1869     s->twoD_destination = 0;
1870     s->twoD_dimension = 0;
1871     s->twoD_control = 0;
1872     s->twoD_pitch = 0;
1873     s->twoD_foreground = 0;
1874     s->twoD_background = 0;
1875     s->twoD_stretch = 0;
1876     s->twoD_color_compare = 0;
1877     s->twoD_color_compare_mask = 0;
1878     s->twoD_mask = 0;
1879     s->twoD_clip_tl = 0;
1880     s->twoD_clip_br = 0;
1881     s->twoD_mono_pattern_low = 0;
1882     s->twoD_mono_pattern_high = 0;
1883     s->twoD_window_width = 0;
1884     s->twoD_source_base = 0;
1885     s->twoD_destination_base = 0;
1886     s->twoD_alpha = 0;
1887     s->twoD_wrap = 0;
1888 }
1889 
1890 static void sm501_init(SM501State *s, DeviceState *dev,
1891                        uint32_t local_mem_bytes)
1892 {
1893 #ifndef CONFIG_PIXMAN
1894     if (s->use_pixman != 0) {
1895         warn_report("x-pixman != 0, not effective without PIXMAN");
1896     }
1897 #endif
1898 
1899     s->local_mem_size_index = get_local_mem_size_index(local_mem_bytes);
1900 
1901     /* local memory */
1902     memory_region_init_ram(&s->local_mem_region, OBJECT(dev), "sm501.local",
1903                            get_local_mem_size(s), &error_fatal);
1904     memory_region_set_log(&s->local_mem_region, true, DIRTY_MEMORY_VGA);
1905     s->local_mem = memory_region_get_ram_ptr(&s->local_mem_region);
1906 
1907     /* i2c */
1908     s->i2c_bus = i2c_init_bus(dev, "sm501.i2c");
1909     /* ddc */
1910     I2CDDCState *ddc = I2CDDC(qdev_new(TYPE_I2CDDC));
1911     i2c_slave_set_address(I2C_SLAVE(ddc), 0x50);
1912     qdev_realize_and_unref(DEVICE(ddc), BUS(s->i2c_bus), &error_abort);
1913 
1914     /* mmio */
1915     memory_region_init(&s->mmio_region, OBJECT(dev), "sm501.mmio", MMIO_SIZE);
1916     memory_region_init_io(&s->system_config_region, OBJECT(dev),
1917                           &sm501_system_config_ops, s,
1918                           "sm501-system-config", 0x6c);
1919     memory_region_add_subregion(&s->mmio_region, SM501_SYS_CONFIG,
1920                                 &s->system_config_region);
1921     memory_region_init_io(&s->i2c_region, OBJECT(dev), &sm501_i2c_ops, s,
1922                           "sm501-i2c", 0x14);
1923     memory_region_add_subregion(&s->mmio_region, SM501_I2C, &s->i2c_region);
1924     memory_region_init_io(&s->disp_ctrl_region, OBJECT(dev),
1925                           &sm501_disp_ctrl_ops, s,
1926                           "sm501-disp-ctrl", 0x1000);
1927     memory_region_add_subregion(&s->mmio_region, SM501_DC,
1928                                 &s->disp_ctrl_region);
1929     memory_region_init_io(&s->twoD_engine_region, OBJECT(dev),
1930                           &sm501_2d_engine_ops, s,
1931                           "sm501-2d-engine", 0x54);
1932     memory_region_add_subregion(&s->mmio_region, SM501_2D_ENGINE,
1933                                 &s->twoD_engine_region);
1934 
1935     /* create qemu graphic console */
1936     s->con = graphic_console_init(dev, 0, &sm501_ops, s);
1937 }
1938 
1939 static const VMStateDescription vmstate_sm501_state = {
1940     .name = "sm501-state",
1941     .version_id = 1,
1942     .minimum_version_id = 1,
1943     .fields = (const VMStateField[]) {
1944         VMSTATE_UINT32(local_mem_size_index, SM501State),
1945         VMSTATE_UINT32(system_control, SM501State),
1946         VMSTATE_UINT32(misc_control, SM501State),
1947         VMSTATE_UINT32(gpio_31_0_control, SM501State),
1948         VMSTATE_UINT32(gpio_63_32_control, SM501State),
1949         VMSTATE_UINT32(dram_control, SM501State),
1950         VMSTATE_UINT32(arbitration_control, SM501State),
1951         VMSTATE_UINT32(irq_mask, SM501State),
1952         VMSTATE_UINT32(misc_timing, SM501State),
1953         VMSTATE_UINT32(power_mode_control, SM501State),
1954         VMSTATE_UINT32(uart0_ier, SM501State),
1955         VMSTATE_UINT32(uart0_lcr, SM501State),
1956         VMSTATE_UINT32(uart0_mcr, SM501State),
1957         VMSTATE_UINT32(uart0_scr, SM501State),
1958         VMSTATE_UINT8_ARRAY(dc_palette, SM501State, DC_PALETTE_ENTRIES),
1959         VMSTATE_UINT32(dc_panel_control, SM501State),
1960         VMSTATE_UINT32(dc_panel_panning_control, SM501State),
1961         VMSTATE_UINT32(dc_panel_fb_addr, SM501State),
1962         VMSTATE_UINT32(dc_panel_fb_offset, SM501State),
1963         VMSTATE_UINT32(dc_panel_fb_width, SM501State),
1964         VMSTATE_UINT32(dc_panel_fb_height, SM501State),
1965         VMSTATE_UINT32(dc_panel_tl_location, SM501State),
1966         VMSTATE_UINT32(dc_panel_br_location, SM501State),
1967         VMSTATE_UINT32(dc_panel_h_total, SM501State),
1968         VMSTATE_UINT32(dc_panel_h_sync, SM501State),
1969         VMSTATE_UINT32(dc_panel_v_total, SM501State),
1970         VMSTATE_UINT32(dc_panel_v_sync, SM501State),
1971         VMSTATE_UINT32(dc_panel_hwc_addr, SM501State),
1972         VMSTATE_UINT32(dc_panel_hwc_location, SM501State),
1973         VMSTATE_UINT32(dc_panel_hwc_color_1_2, SM501State),
1974         VMSTATE_UINT32(dc_panel_hwc_color_3, SM501State),
1975         VMSTATE_UINT32(dc_video_control, SM501State),
1976         VMSTATE_UINT32(dc_crt_control, SM501State),
1977         VMSTATE_UINT32(dc_crt_fb_addr, SM501State),
1978         VMSTATE_UINT32(dc_crt_fb_offset, SM501State),
1979         VMSTATE_UINT32(dc_crt_h_total, SM501State),
1980         VMSTATE_UINT32(dc_crt_h_sync, SM501State),
1981         VMSTATE_UINT32(dc_crt_v_total, SM501State),
1982         VMSTATE_UINT32(dc_crt_v_sync, SM501State),
1983         VMSTATE_UINT32(dc_crt_hwc_addr, SM501State),
1984         VMSTATE_UINT32(dc_crt_hwc_location, SM501State),
1985         VMSTATE_UINT32(dc_crt_hwc_color_1_2, SM501State),
1986         VMSTATE_UINT32(dc_crt_hwc_color_3, SM501State),
1987         VMSTATE_UINT32(twoD_source, SM501State),
1988         VMSTATE_UINT32(twoD_destination, SM501State),
1989         VMSTATE_UINT32(twoD_dimension, SM501State),
1990         VMSTATE_UINT32(twoD_control, SM501State),
1991         VMSTATE_UINT32(twoD_pitch, SM501State),
1992         VMSTATE_UINT32(twoD_foreground, SM501State),
1993         VMSTATE_UINT32(twoD_background, SM501State),
1994         VMSTATE_UINT32(twoD_stretch, SM501State),
1995         VMSTATE_UINT32(twoD_color_compare, SM501State),
1996         VMSTATE_UINT32(twoD_color_compare_mask, SM501State),
1997         VMSTATE_UINT32(twoD_mask, SM501State),
1998         VMSTATE_UINT32(twoD_clip_tl, SM501State),
1999         VMSTATE_UINT32(twoD_clip_br, SM501State),
2000         VMSTATE_UINT32(twoD_mono_pattern_low, SM501State),
2001         VMSTATE_UINT32(twoD_mono_pattern_high, SM501State),
2002         VMSTATE_UINT32(twoD_window_width, SM501State),
2003         VMSTATE_UINT32(twoD_source_base, SM501State),
2004         VMSTATE_UINT32(twoD_destination_base, SM501State),
2005         VMSTATE_UINT32(twoD_alpha, SM501State),
2006         VMSTATE_UINT32(twoD_wrap, SM501State),
2007         /* Added in version 2 */
2008         VMSTATE_UINT8(i2c_byte_count, SM501State),
2009         VMSTATE_UINT8(i2c_status, SM501State),
2010         VMSTATE_UINT8(i2c_addr, SM501State),
2011         VMSTATE_UINT8_ARRAY(i2c_data, SM501State, 16),
2012         VMSTATE_END_OF_LIST()
2013      }
2014 };
2015 
2016 #define TYPE_SYSBUS_SM501 "sysbus-sm501"
2017 OBJECT_DECLARE_SIMPLE_TYPE(SM501SysBusState, SYSBUS_SM501)
2018 
2019 struct SM501SysBusState {
2020     /*< private >*/
2021     SysBusDevice parent_obj;
2022     /*< public >*/
2023     SM501State state;
2024     uint32_t vram_size;
2025     SerialMM serial;
2026     OHCISysBusState ohci;
2027 };
2028 
2029 static void sm501_realize_sysbus(DeviceState *dev, Error **errp)
2030 {
2031     SM501SysBusState *s = SYSBUS_SM501(dev);
2032     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
2033     MemoryRegion *mr;
2034 
2035     sm501_init(&s->state, dev, s->vram_size);
2036     if (get_local_mem_size(&s->state) != s->vram_size) {
2037         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
2038                    get_local_mem_size(&s->state));
2039         return;
2040     }
2041     sysbus_init_mmio(sbd, &s->state.local_mem_region);
2042     sysbus_init_mmio(sbd, &s->state.mmio_region);
2043 
2044     /* bridge to usb host emulation module */
2045     sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->ohci), &error_fatal);
2046     memory_region_add_subregion(&s->state.mmio_region, SM501_USB_HOST,
2047                        sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->ohci), 0));
2048     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(&s->ohci));
2049 
2050     /* bridge to serial emulation module */
2051     sysbus_realize(SYS_BUS_DEVICE(&s->serial), &error_fatal);
2052     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->serial), 0);
2053     memory_region_add_subregion(&s->state.mmio_region, SM501_UART0, mr);
2054     /* TODO : chain irq to IRL */
2055 }
2056 
2057 static Property sm501_sysbus_properties[] = {
2058     DEFINE_PROP_UINT32("vram-size", SM501SysBusState, vram_size, 0),
2059     /* this a debug option, prefer PROP_UINT over PROP_BIT for simplicity */
2060     DEFINE_PROP_UINT8("x-pixman", SM501SysBusState, state.use_pixman, DEFAULT_X_PIXMAN),
2061     DEFINE_PROP_END_OF_LIST(),
2062 };
2063 
2064 static void sm501_reset_sysbus(DeviceState *dev)
2065 {
2066     SM501SysBusState *s = SYSBUS_SM501(dev);
2067     sm501_reset(&s->state);
2068 }
2069 
2070 static const VMStateDescription vmstate_sm501_sysbus = {
2071     .name = TYPE_SYSBUS_SM501,
2072     .version_id = 2,
2073     .minimum_version_id = 2,
2074     .fields = (const VMStateField[]) {
2075         VMSTATE_STRUCT(state, SM501SysBusState, 1,
2076                        vmstate_sm501_state, SM501State),
2077         VMSTATE_END_OF_LIST()
2078      }
2079 };
2080 
2081 static void sm501_sysbus_class_init(ObjectClass *klass, void *data)
2082 {
2083     DeviceClass *dc = DEVICE_CLASS(klass);
2084 
2085     dc->realize = sm501_realize_sysbus;
2086     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2087     dc->desc = "SM501 Multimedia Companion";
2088     device_class_set_props(dc, sm501_sysbus_properties);
2089     dc->reset = sm501_reset_sysbus;
2090     dc->vmsd = &vmstate_sm501_sysbus;
2091 }
2092 
2093 static void sm501_sysbus_init(Object *o)
2094 {
2095     SM501SysBusState *sm501 = SYSBUS_SM501(o);
2096     OHCISysBusState *ohci = &sm501->ohci;
2097     SerialMM *smm = &sm501->serial;
2098 
2099     object_initialize_child(o, "ohci", ohci, TYPE_SYSBUS_OHCI);
2100     object_property_add_alias(o, "dma-offset", OBJECT(ohci), "dma-offset");
2101     qdev_prop_set_uint32(DEVICE(ohci), "num-ports", 2);
2102 
2103     object_initialize_child(o, "serial", smm, TYPE_SERIAL_MM);
2104     qdev_set_legacy_instance_id(DEVICE(smm), SM501_UART0, 2);
2105     qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
2106     qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
2107 
2108     object_property_add_alias(o, "chardev", OBJECT(smm), "chardev");
2109 }
2110 
2111 static const TypeInfo sm501_sysbus_info = {
2112     .name          = TYPE_SYSBUS_SM501,
2113     .parent        = TYPE_SYS_BUS_DEVICE,
2114     .instance_size = sizeof(SM501SysBusState),
2115     .class_init    = sm501_sysbus_class_init,
2116     .instance_init = sm501_sysbus_init,
2117 };
2118 
2119 #define TYPE_PCI_SM501 "sm501"
2120 OBJECT_DECLARE_SIMPLE_TYPE(SM501PCIState, PCI_SM501)
2121 
2122 struct SM501PCIState {
2123     /*< private >*/
2124     PCIDevice parent_obj;
2125     /*< public >*/
2126     SM501State state;
2127     uint32_t vram_size;
2128 };
2129 
2130 static void sm501_realize_pci(PCIDevice *dev, Error **errp)
2131 {
2132     SM501PCIState *s = PCI_SM501(dev);
2133 
2134     sm501_init(&s->state, DEVICE(dev), s->vram_size);
2135     if (get_local_mem_size(&s->state) != s->vram_size) {
2136         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
2137                    get_local_mem_size(&s->state));
2138         return;
2139     }
2140     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
2141                      &s->state.local_mem_region);
2142     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY,
2143                      &s->state.mmio_region);
2144 }
2145 
2146 static Property sm501_pci_properties[] = {
2147     DEFINE_PROP_UINT32("vram-size", SM501PCIState, vram_size, 64 * MiB),
2148     DEFINE_PROP_UINT8("x-pixman", SM501PCIState, state.use_pixman, DEFAULT_X_PIXMAN),
2149     DEFINE_PROP_END_OF_LIST(),
2150 };
2151 
2152 static void sm501_reset_pci(DeviceState *dev)
2153 {
2154     SM501PCIState *s = PCI_SM501(dev);
2155     sm501_reset(&s->state);
2156     /* Bits 2:0 of misc_control register is 001 for PCI */
2157     s->state.misc_control |= 1;
2158 }
2159 
2160 static const VMStateDescription vmstate_sm501_pci = {
2161     .name = TYPE_PCI_SM501,
2162     .version_id = 2,
2163     .minimum_version_id = 2,
2164     .fields = (const VMStateField[]) {
2165         VMSTATE_PCI_DEVICE(parent_obj, SM501PCIState),
2166         VMSTATE_STRUCT(state, SM501PCIState, 1,
2167                        vmstate_sm501_state, SM501State),
2168         VMSTATE_END_OF_LIST()
2169      }
2170 };
2171 
2172 static void sm501_pci_class_init(ObjectClass *klass, void *data)
2173 {
2174     DeviceClass *dc = DEVICE_CLASS(klass);
2175     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2176 
2177     k->realize = sm501_realize_pci;
2178     k->vendor_id = PCI_VENDOR_ID_SILICON_MOTION;
2179     k->device_id = PCI_DEVICE_ID_SM501;
2180     k->class_id = PCI_CLASS_DISPLAY_OTHER;
2181     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2182     dc->desc = "SM501 Display Controller";
2183     device_class_set_props(dc, sm501_pci_properties);
2184     dc->reset = sm501_reset_pci;
2185     dc->hotpluggable = false;
2186     dc->vmsd = &vmstate_sm501_pci;
2187 }
2188 
2189 static void sm501_pci_init(Object *o)
2190 {
2191     object_property_set_description(o, "x-pixman", "Use pixman for: "
2192                                     "1: fill, 2: blit, 4: overlap blit");
2193 }
2194 
2195 static const TypeInfo sm501_pci_info = {
2196     .name          = TYPE_PCI_SM501,
2197     .parent        = TYPE_PCI_DEVICE,
2198     .instance_size = sizeof(SM501PCIState),
2199     .class_init    = sm501_pci_class_init,
2200     .instance_init = sm501_pci_init,
2201     .interfaces = (InterfaceInfo[]) {
2202         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2203         { },
2204     },
2205 };
2206 
2207 static void sm501_register_types(void)
2208 {
2209     type_register_static(&sm501_sysbus_info);
2210     type_register_static(&sm501_pci_info);
2211 }
2212 
2213 type_init(sm501_register_types)
2214