xref: /openbmc/qemu/hw/display/sm501.c (revision be99a9a0)
1 /*
2  * QEMU SM501 Device
3  *
4  * Copyright (c) 2008 Shin-ichiro KAWASAKI
5  * Copyright (c) 2016-2020 BALATON Zoltan
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "qemu/units.h"
28 #include "qapi/error.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "hw/char/serial.h"
32 #include "ui/console.h"
33 #include "hw/sysbus.h"
34 #include "migration/vmstate.h"
35 #include "hw/pci/pci.h"
36 #include "hw/qdev-properties.h"
37 #include "hw/i2c/i2c.h"
38 #include "hw/display/i2c-ddc.h"
39 #include "qemu/range.h"
40 #include "ui/pixel_ops.h"
41 #include "qemu/bswap.h"
42 #include "trace.h"
43 
44 #define MMIO_BASE_OFFSET 0x3e00000
45 #define MMIO_SIZE 0x200000
46 #define DC_PALETTE_ENTRIES (0x400 * 3)
47 
48 /* SM501 register definitions taken from "linux/include/linux/sm501-regs.h" */
49 
50 /* System Configuration area */
51 /* System config base */
52 #define SM501_SYS_CONFIG                (0x000000)
53 
54 /* config 1 */
55 #define SM501_SYSTEM_CONTROL            (0x000000)
56 
57 #define SM501_SYSCTRL_PANEL_TRISTATE    (1 << 0)
58 #define SM501_SYSCTRL_MEM_TRISTATE      (1 << 1)
59 #define SM501_SYSCTRL_CRT_TRISTATE      (1 << 2)
60 
61 #define SM501_SYSCTRL_PCI_SLAVE_BURST_MASK (3 << 4)
62 #define SM501_SYSCTRL_PCI_SLAVE_BURST_1 (0 << 4)
63 #define SM501_SYSCTRL_PCI_SLAVE_BURST_2 (1 << 4)
64 #define SM501_SYSCTRL_PCI_SLAVE_BURST_4 (2 << 4)
65 #define SM501_SYSCTRL_PCI_SLAVE_BURST_8 (3 << 4)
66 
67 #define SM501_SYSCTRL_PCI_CLOCK_RUN_EN  (1 << 6)
68 #define SM501_SYSCTRL_PCI_RETRY_DISABLE (1 << 7)
69 #define SM501_SYSCTRL_PCI_SUBSYS_LOCK   (1 << 11)
70 #define SM501_SYSCTRL_PCI_BURST_READ_EN (1 << 15)
71 
72 /* miscellaneous control */
73 
74 #define SM501_MISC_CONTROL              (0x000004)
75 
76 #define SM501_MISC_BUS_SH               (0x0)
77 #define SM501_MISC_BUS_PCI              (0x1)
78 #define SM501_MISC_BUS_XSCALE           (0x2)
79 #define SM501_MISC_BUS_NEC              (0x6)
80 #define SM501_MISC_BUS_MASK             (0x7)
81 
82 #define SM501_MISC_VR_62MB              (1 << 3)
83 #define SM501_MISC_CDR_RESET            (1 << 7)
84 #define SM501_MISC_USB_LB               (1 << 8)
85 #define SM501_MISC_USB_SLAVE            (1 << 9)
86 #define SM501_MISC_BL_1                 (1 << 10)
87 #define SM501_MISC_MC                   (1 << 11)
88 #define SM501_MISC_DAC_POWER            (1 << 12)
89 #define SM501_MISC_IRQ_INVERT           (1 << 16)
90 #define SM501_MISC_SH                   (1 << 17)
91 
92 #define SM501_MISC_HOLD_EMPTY           (0 << 18)
93 #define SM501_MISC_HOLD_8               (1 << 18)
94 #define SM501_MISC_HOLD_16              (2 << 18)
95 #define SM501_MISC_HOLD_24              (3 << 18)
96 #define SM501_MISC_HOLD_32              (4 << 18)
97 #define SM501_MISC_HOLD_MASK            (7 << 18)
98 
99 #define SM501_MISC_FREQ_12              (1 << 24)
100 #define SM501_MISC_PNL_24BIT            (1 << 25)
101 #define SM501_MISC_8051_LE              (1 << 26)
102 
103 
104 
105 #define SM501_GPIO31_0_CONTROL          (0x000008)
106 #define SM501_GPIO63_32_CONTROL         (0x00000C)
107 #define SM501_DRAM_CONTROL              (0x000010)
108 
109 /* command list */
110 #define SM501_ARBTRTN_CONTROL           (0x000014)
111 
112 /* command list */
113 #define SM501_COMMAND_LIST_STATUS       (0x000024)
114 
115 /* interrupt debug */
116 #define SM501_RAW_IRQ_STATUS            (0x000028)
117 #define SM501_RAW_IRQ_CLEAR             (0x000028)
118 #define SM501_IRQ_STATUS                (0x00002C)
119 #define SM501_IRQ_MASK                  (0x000030)
120 #define SM501_DEBUG_CONTROL             (0x000034)
121 
122 /* power management */
123 #define SM501_POWERMODE_P2X_SRC         (1 << 29)
124 #define SM501_POWERMODE_V2X_SRC         (1 << 20)
125 #define SM501_POWERMODE_M_SRC           (1 << 12)
126 #define SM501_POWERMODE_M1_SRC          (1 << 4)
127 
128 #define SM501_CURRENT_GATE              (0x000038)
129 #define SM501_CURRENT_CLOCK             (0x00003C)
130 #define SM501_POWER_MODE_0_GATE         (0x000040)
131 #define SM501_POWER_MODE_0_CLOCK        (0x000044)
132 #define SM501_POWER_MODE_1_GATE         (0x000048)
133 #define SM501_POWER_MODE_1_CLOCK        (0x00004C)
134 #define SM501_SLEEP_MODE_GATE           (0x000050)
135 #define SM501_POWER_MODE_CONTROL        (0x000054)
136 
137 /* power gates for units within the 501 */
138 #define SM501_GATE_HOST                 (0)
139 #define SM501_GATE_MEMORY               (1)
140 #define SM501_GATE_DISPLAY              (2)
141 #define SM501_GATE_2D_ENGINE            (3)
142 #define SM501_GATE_CSC                  (4)
143 #define SM501_GATE_ZVPORT               (5)
144 #define SM501_GATE_GPIO                 (6)
145 #define SM501_GATE_UART0                (7)
146 #define SM501_GATE_UART1                (8)
147 #define SM501_GATE_SSP                  (10)
148 #define SM501_GATE_USB_HOST             (11)
149 #define SM501_GATE_USB_GADGET           (12)
150 #define SM501_GATE_UCONTROLLER          (17)
151 #define SM501_GATE_AC97                 (18)
152 
153 /* panel clock */
154 #define SM501_CLOCK_P2XCLK              (24)
155 /* crt clock */
156 #define SM501_CLOCK_V2XCLK              (16)
157 /* main clock */
158 #define SM501_CLOCK_MCLK                (8)
159 /* SDRAM controller clock */
160 #define SM501_CLOCK_M1XCLK              (0)
161 
162 /* config 2 */
163 #define SM501_PCI_MASTER_BASE           (0x000058)
164 #define SM501_ENDIAN_CONTROL            (0x00005C)
165 #define SM501_DEVICEID                  (0x000060)
166 /* 0x050100A0 */
167 
168 #define SM501_DEVICEID_SM501            (0x05010000)
169 #define SM501_DEVICEID_IDMASK           (0xffff0000)
170 #define SM501_DEVICEID_REVMASK          (0x000000ff)
171 
172 #define SM501_PLLCLOCK_COUNT            (0x000064)
173 #define SM501_MISC_TIMING               (0x000068)
174 #define SM501_CURRENT_SDRAM_CLOCK       (0x00006C)
175 
176 #define SM501_PROGRAMMABLE_PLL_CONTROL  (0x000074)
177 
178 /* GPIO base */
179 #define SM501_GPIO                      (0x010000)
180 #define SM501_GPIO_DATA_LOW             (0x00)
181 #define SM501_GPIO_DATA_HIGH            (0x04)
182 #define SM501_GPIO_DDR_LOW              (0x08)
183 #define SM501_GPIO_DDR_HIGH             (0x0C)
184 #define SM501_GPIO_IRQ_SETUP            (0x10)
185 #define SM501_GPIO_IRQ_STATUS           (0x14)
186 #define SM501_GPIO_IRQ_RESET            (0x14)
187 
188 /* I2C controller base */
189 #define SM501_I2C                       (0x010040)
190 #define SM501_I2C_BYTE_COUNT            (0x00)
191 #define SM501_I2C_CONTROL               (0x01)
192 #define SM501_I2C_STATUS                (0x02)
193 #define SM501_I2C_RESET                 (0x02)
194 #define SM501_I2C_SLAVE_ADDRESS         (0x03)
195 #define SM501_I2C_DATA                  (0x04)
196 
197 #define SM501_I2C_CONTROL_START         (1 << 2)
198 #define SM501_I2C_CONTROL_ENABLE        (1 << 0)
199 
200 #define SM501_I2C_STATUS_COMPLETE       (1 << 3)
201 #define SM501_I2C_STATUS_ERROR          (1 << 2)
202 
203 #define SM501_I2C_RESET_ERROR           (1 << 2)
204 
205 /* SSP base */
206 #define SM501_SSP                       (0x020000)
207 
208 /* Uart 0 base */
209 #define SM501_UART0                     (0x030000)
210 
211 /* Uart 1 base */
212 #define SM501_UART1                     (0x030020)
213 
214 /* USB host port base */
215 #define SM501_USB_HOST                  (0x040000)
216 
217 /* USB slave/gadget base */
218 #define SM501_USB_GADGET                (0x060000)
219 
220 /* USB slave/gadget data port base */
221 #define SM501_USB_GADGET_DATA           (0x070000)
222 
223 /* Display controller/video engine base */
224 #define SM501_DC                        (0x080000)
225 
226 /* common defines for the SM501 address registers */
227 #define SM501_ADDR_FLIP                 (1 << 31)
228 #define SM501_ADDR_EXT                  (1 << 27)
229 #define SM501_ADDR_CS1                  (1 << 26)
230 #define SM501_ADDR_MASK                 (0x3f << 26)
231 
232 #define SM501_FIFO_MASK                 (0x3 << 16)
233 #define SM501_FIFO_1                    (0x0 << 16)
234 #define SM501_FIFO_3                    (0x1 << 16)
235 #define SM501_FIFO_7                    (0x2 << 16)
236 #define SM501_FIFO_11                   (0x3 << 16)
237 
238 /* common registers for panel and the crt */
239 #define SM501_OFF_DC_H_TOT              (0x000)
240 #define SM501_OFF_DC_V_TOT              (0x008)
241 #define SM501_OFF_DC_H_SYNC             (0x004)
242 #define SM501_OFF_DC_V_SYNC             (0x00C)
243 
244 #define SM501_DC_PANEL_CONTROL          (0x000)
245 
246 #define SM501_DC_PANEL_CONTROL_FPEN     (1 << 27)
247 #define SM501_DC_PANEL_CONTROL_BIAS     (1 << 26)
248 #define SM501_DC_PANEL_CONTROL_DATA     (1 << 25)
249 #define SM501_DC_PANEL_CONTROL_VDD      (1 << 24)
250 #define SM501_DC_PANEL_CONTROL_DP       (1 << 23)
251 
252 #define SM501_DC_PANEL_CONTROL_TFT_888  (0 << 21)
253 #define SM501_DC_PANEL_CONTROL_TFT_333  (1 << 21)
254 #define SM501_DC_PANEL_CONTROL_TFT_444  (2 << 21)
255 
256 #define SM501_DC_PANEL_CONTROL_DE       (1 << 20)
257 
258 #define SM501_DC_PANEL_CONTROL_LCD_TFT  (0 << 18)
259 #define SM501_DC_PANEL_CONTROL_LCD_STN8 (1 << 18)
260 #define SM501_DC_PANEL_CONTROL_LCD_STN12 (2 << 18)
261 
262 #define SM501_DC_PANEL_CONTROL_CP       (1 << 14)
263 #define SM501_DC_PANEL_CONTROL_VSP      (1 << 13)
264 #define SM501_DC_PANEL_CONTROL_HSP      (1 << 12)
265 #define SM501_DC_PANEL_CONTROL_CK       (1 << 9)
266 #define SM501_DC_PANEL_CONTROL_TE       (1 << 8)
267 #define SM501_DC_PANEL_CONTROL_VPD      (1 << 7)
268 #define SM501_DC_PANEL_CONTROL_VP       (1 << 6)
269 #define SM501_DC_PANEL_CONTROL_HPD      (1 << 5)
270 #define SM501_DC_PANEL_CONTROL_HP       (1 << 4)
271 #define SM501_DC_PANEL_CONTROL_GAMMA    (1 << 3)
272 #define SM501_DC_PANEL_CONTROL_EN       (1 << 2)
273 
274 #define SM501_DC_PANEL_CONTROL_8BPP     (0 << 0)
275 #define SM501_DC_PANEL_CONTROL_16BPP    (1 << 0)
276 #define SM501_DC_PANEL_CONTROL_32BPP    (2 << 0)
277 
278 
279 #define SM501_DC_PANEL_PANNING_CONTROL  (0x004)
280 #define SM501_DC_PANEL_COLOR_KEY        (0x008)
281 #define SM501_DC_PANEL_FB_ADDR          (0x00C)
282 #define SM501_DC_PANEL_FB_OFFSET        (0x010)
283 #define SM501_DC_PANEL_FB_WIDTH         (0x014)
284 #define SM501_DC_PANEL_FB_HEIGHT        (0x018)
285 #define SM501_DC_PANEL_TL_LOC           (0x01C)
286 #define SM501_DC_PANEL_BR_LOC           (0x020)
287 #define SM501_DC_PANEL_H_TOT            (0x024)
288 #define SM501_DC_PANEL_H_SYNC           (0x028)
289 #define SM501_DC_PANEL_V_TOT            (0x02C)
290 #define SM501_DC_PANEL_V_SYNC           (0x030)
291 #define SM501_DC_PANEL_CUR_LINE         (0x034)
292 
293 #define SM501_DC_VIDEO_CONTROL          (0x040)
294 #define SM501_DC_VIDEO_FB0_ADDR         (0x044)
295 #define SM501_DC_VIDEO_FB_WIDTH         (0x048)
296 #define SM501_DC_VIDEO_FB0_LAST_ADDR    (0x04C)
297 #define SM501_DC_VIDEO_TL_LOC           (0x050)
298 #define SM501_DC_VIDEO_BR_LOC           (0x054)
299 #define SM501_DC_VIDEO_SCALE            (0x058)
300 #define SM501_DC_VIDEO_INIT_SCALE       (0x05C)
301 #define SM501_DC_VIDEO_YUV_CONSTANTS    (0x060)
302 #define SM501_DC_VIDEO_FB1_ADDR         (0x064)
303 #define SM501_DC_VIDEO_FB1_LAST_ADDR    (0x068)
304 
305 #define SM501_DC_VIDEO_ALPHA_CONTROL    (0x080)
306 #define SM501_DC_VIDEO_ALPHA_FB_ADDR    (0x084)
307 #define SM501_DC_VIDEO_ALPHA_FB_OFFSET  (0x088)
308 #define SM501_DC_VIDEO_ALPHA_FB_LAST_ADDR (0x08C)
309 #define SM501_DC_VIDEO_ALPHA_TL_LOC     (0x090)
310 #define SM501_DC_VIDEO_ALPHA_BR_LOC     (0x094)
311 #define SM501_DC_VIDEO_ALPHA_SCALE      (0x098)
312 #define SM501_DC_VIDEO_ALPHA_INIT_SCALE (0x09C)
313 #define SM501_DC_VIDEO_ALPHA_CHROMA_KEY (0x0A0)
314 #define SM501_DC_VIDEO_ALPHA_COLOR_LOOKUP (0x0A4)
315 
316 #define SM501_DC_PANEL_HWC_BASE         (0x0F0)
317 #define SM501_DC_PANEL_HWC_ADDR         (0x0F0)
318 #define SM501_DC_PANEL_HWC_LOC          (0x0F4)
319 #define SM501_DC_PANEL_HWC_COLOR_1_2    (0x0F8)
320 #define SM501_DC_PANEL_HWC_COLOR_3      (0x0FC)
321 
322 #define SM501_HWC_EN                    (1 << 31)
323 
324 #define SM501_OFF_HWC_ADDR              (0x00)
325 #define SM501_OFF_HWC_LOC               (0x04)
326 #define SM501_OFF_HWC_COLOR_1_2         (0x08)
327 #define SM501_OFF_HWC_COLOR_3           (0x0C)
328 
329 #define SM501_DC_ALPHA_CONTROL          (0x100)
330 #define SM501_DC_ALPHA_FB_ADDR          (0x104)
331 #define SM501_DC_ALPHA_FB_OFFSET        (0x108)
332 #define SM501_DC_ALPHA_TL_LOC           (0x10C)
333 #define SM501_DC_ALPHA_BR_LOC           (0x110)
334 #define SM501_DC_ALPHA_CHROMA_KEY       (0x114)
335 #define SM501_DC_ALPHA_COLOR_LOOKUP     (0x118)
336 
337 #define SM501_DC_CRT_CONTROL            (0x200)
338 
339 #define SM501_DC_CRT_CONTROL_TVP        (1 << 15)
340 #define SM501_DC_CRT_CONTROL_CP         (1 << 14)
341 #define SM501_DC_CRT_CONTROL_VSP        (1 << 13)
342 #define SM501_DC_CRT_CONTROL_HSP        (1 << 12)
343 #define SM501_DC_CRT_CONTROL_VS         (1 << 11)
344 #define SM501_DC_CRT_CONTROL_BLANK      (1 << 10)
345 #define SM501_DC_CRT_CONTROL_SEL        (1 << 9)
346 #define SM501_DC_CRT_CONTROL_TE         (1 << 8)
347 #define SM501_DC_CRT_CONTROL_PIXEL_MASK (0xF << 4)
348 #define SM501_DC_CRT_CONTROL_GAMMA      (1 << 3)
349 #define SM501_DC_CRT_CONTROL_ENABLE     (1 << 2)
350 
351 #define SM501_DC_CRT_CONTROL_8BPP       (0 << 0)
352 #define SM501_DC_CRT_CONTROL_16BPP      (1 << 0)
353 #define SM501_DC_CRT_CONTROL_32BPP      (2 << 0)
354 
355 #define SM501_DC_CRT_FB_ADDR            (0x204)
356 #define SM501_DC_CRT_FB_OFFSET          (0x208)
357 #define SM501_DC_CRT_H_TOT              (0x20C)
358 #define SM501_DC_CRT_H_SYNC             (0x210)
359 #define SM501_DC_CRT_V_TOT              (0x214)
360 #define SM501_DC_CRT_V_SYNC             (0x218)
361 #define SM501_DC_CRT_SIGNATURE_ANALYZER (0x21C)
362 #define SM501_DC_CRT_CUR_LINE           (0x220)
363 #define SM501_DC_CRT_MONITOR_DETECT     (0x224)
364 
365 #define SM501_DC_CRT_HWC_BASE           (0x230)
366 #define SM501_DC_CRT_HWC_ADDR           (0x230)
367 #define SM501_DC_CRT_HWC_LOC            (0x234)
368 #define SM501_DC_CRT_HWC_COLOR_1_2      (0x238)
369 #define SM501_DC_CRT_HWC_COLOR_3        (0x23C)
370 
371 #define SM501_DC_PANEL_PALETTE          (0x400)
372 
373 #define SM501_DC_VIDEO_PALETTE          (0x800)
374 
375 #define SM501_DC_CRT_PALETTE            (0xC00)
376 
377 /* Zoom Video port base */
378 #define SM501_ZVPORT                    (0x090000)
379 
380 /* AC97/I2S base */
381 #define SM501_AC97                      (0x0A0000)
382 
383 /* 8051 micro controller base */
384 #define SM501_UCONTROLLER               (0x0B0000)
385 
386 /* 8051 micro controller SRAM base */
387 #define SM501_UCONTROLLER_SRAM          (0x0C0000)
388 
389 /* DMA base */
390 #define SM501_DMA                       (0x0D0000)
391 
392 /* 2d engine base */
393 #define SM501_2D_ENGINE                 (0x100000)
394 #define SM501_2D_SOURCE                 (0x00)
395 #define SM501_2D_DESTINATION            (0x04)
396 #define SM501_2D_DIMENSION              (0x08)
397 #define SM501_2D_CONTROL                (0x0C)
398 #define SM501_2D_PITCH                  (0x10)
399 #define SM501_2D_FOREGROUND             (0x14)
400 #define SM501_2D_BACKGROUND             (0x18)
401 #define SM501_2D_STRETCH                (0x1C)
402 #define SM501_2D_COLOR_COMPARE          (0x20)
403 #define SM501_2D_COLOR_COMPARE_MASK     (0x24)
404 #define SM501_2D_MASK                   (0x28)
405 #define SM501_2D_CLIP_TL                (0x2C)
406 #define SM501_2D_CLIP_BR                (0x30)
407 #define SM501_2D_MONO_PATTERN_LOW       (0x34)
408 #define SM501_2D_MONO_PATTERN_HIGH      (0x38)
409 #define SM501_2D_WINDOW_WIDTH           (0x3C)
410 #define SM501_2D_SOURCE_BASE            (0x40)
411 #define SM501_2D_DESTINATION_BASE       (0x44)
412 #define SM501_2D_ALPHA                  (0x48)
413 #define SM501_2D_WRAP                   (0x4C)
414 #define SM501_2D_STATUS                 (0x50)
415 
416 #define SM501_CSC_Y_SOURCE_BASE         (0xC8)
417 #define SM501_CSC_CONSTANTS             (0xCC)
418 #define SM501_CSC_Y_SOURCE_X            (0xD0)
419 #define SM501_CSC_Y_SOURCE_Y            (0xD4)
420 #define SM501_CSC_U_SOURCE_BASE         (0xD8)
421 #define SM501_CSC_V_SOURCE_BASE         (0xDC)
422 #define SM501_CSC_SOURCE_DIMENSION      (0xE0)
423 #define SM501_CSC_SOURCE_PITCH          (0xE4)
424 #define SM501_CSC_DESTINATION           (0xE8)
425 #define SM501_CSC_DESTINATION_DIMENSION (0xEC)
426 #define SM501_CSC_DESTINATION_PITCH     (0xF0)
427 #define SM501_CSC_SCALE_FACTOR          (0xF4)
428 #define SM501_CSC_DESTINATION_BASE      (0xF8)
429 #define SM501_CSC_CONTROL               (0xFC)
430 
431 /* 2d engine data port base */
432 #define SM501_2D_ENGINE_DATA            (0x110000)
433 
434 /* end of register definitions */
435 
436 #define SM501_HWC_WIDTH                       (64)
437 #define SM501_HWC_HEIGHT                      (64)
438 
439 /* SM501 local memory size taken from "linux/drivers/mfd/sm501.c" */
440 static const uint32_t sm501_mem_local_size[] = {
441     [0] = 4 * MiB,
442     [1] = 8 * MiB,
443     [2] = 16 * MiB,
444     [3] = 32 * MiB,
445     [4] = 64 * MiB,
446     [5] = 2 * MiB,
447 };
448 #define get_local_mem_size(s) sm501_mem_local_size[(s)->local_mem_size_index]
449 
450 typedef struct SM501State {
451     /* graphic console status */
452     QemuConsole *con;
453 
454     /* status & internal resources */
455     uint32_t local_mem_size_index;
456     uint8_t *local_mem;
457     MemoryRegion local_mem_region;
458     MemoryRegion mmio_region;
459     MemoryRegion system_config_region;
460     MemoryRegion i2c_region;
461     MemoryRegion disp_ctrl_region;
462     MemoryRegion twoD_engine_region;
463     uint32_t last_width;
464     uint32_t last_height;
465     bool do_full_update; /* perform a full update next time */
466     I2CBus *i2c_bus;
467 
468     /* mmio registers */
469     uint32_t system_control;
470     uint32_t misc_control;
471     uint32_t gpio_31_0_control;
472     uint32_t gpio_63_32_control;
473     uint32_t dram_control;
474     uint32_t arbitration_control;
475     uint32_t irq_mask;
476     uint32_t misc_timing;
477     uint32_t power_mode_control;
478 
479     uint8_t i2c_byte_count;
480     uint8_t i2c_status;
481     uint8_t i2c_addr;
482     uint8_t i2c_data[16];
483 
484     uint32_t uart0_ier;
485     uint32_t uart0_lcr;
486     uint32_t uart0_mcr;
487     uint32_t uart0_scr;
488 
489     uint8_t dc_palette[DC_PALETTE_ENTRIES];
490 
491     uint32_t dc_panel_control;
492     uint32_t dc_panel_panning_control;
493     uint32_t dc_panel_fb_addr;
494     uint32_t dc_panel_fb_offset;
495     uint32_t dc_panel_fb_width;
496     uint32_t dc_panel_fb_height;
497     uint32_t dc_panel_tl_location;
498     uint32_t dc_panel_br_location;
499     uint32_t dc_panel_h_total;
500     uint32_t dc_panel_h_sync;
501     uint32_t dc_panel_v_total;
502     uint32_t dc_panel_v_sync;
503 
504     uint32_t dc_panel_hwc_addr;
505     uint32_t dc_panel_hwc_location;
506     uint32_t dc_panel_hwc_color_1_2;
507     uint32_t dc_panel_hwc_color_3;
508 
509     uint32_t dc_video_control;
510 
511     uint32_t dc_crt_control;
512     uint32_t dc_crt_fb_addr;
513     uint32_t dc_crt_fb_offset;
514     uint32_t dc_crt_h_total;
515     uint32_t dc_crt_h_sync;
516     uint32_t dc_crt_v_total;
517     uint32_t dc_crt_v_sync;
518 
519     uint32_t dc_crt_hwc_addr;
520     uint32_t dc_crt_hwc_location;
521     uint32_t dc_crt_hwc_color_1_2;
522     uint32_t dc_crt_hwc_color_3;
523 
524     uint32_t twoD_source;
525     uint32_t twoD_destination;
526     uint32_t twoD_dimension;
527     uint32_t twoD_control;
528     uint32_t twoD_pitch;
529     uint32_t twoD_foreground;
530     uint32_t twoD_background;
531     uint32_t twoD_stretch;
532     uint32_t twoD_color_compare;
533     uint32_t twoD_color_compare_mask;
534     uint32_t twoD_mask;
535     uint32_t twoD_clip_tl;
536     uint32_t twoD_clip_br;
537     uint32_t twoD_mono_pattern_low;
538     uint32_t twoD_mono_pattern_high;
539     uint32_t twoD_window_width;
540     uint32_t twoD_source_base;
541     uint32_t twoD_destination_base;
542     uint32_t twoD_alpha;
543     uint32_t twoD_wrap;
544 } SM501State;
545 
546 static uint32_t get_local_mem_size_index(uint32_t size)
547 {
548     uint32_t norm_size = 0;
549     int i, index = 0;
550 
551     for (i = 0; i < ARRAY_SIZE(sm501_mem_local_size); i++) {
552         uint32_t new_size = sm501_mem_local_size[i];
553         if (new_size >= size) {
554             if (norm_size == 0 || norm_size > new_size) {
555                 norm_size = new_size;
556                 index = i;
557             }
558         }
559     }
560 
561     return index;
562 }
563 
564 static ram_addr_t get_fb_addr(SM501State *s, int crt)
565 {
566     return (crt ? s->dc_crt_fb_addr : s->dc_panel_fb_addr) & 0x3FFFFF0;
567 }
568 
569 static inline int get_width(SM501State *s, int crt)
570 {
571     int width = crt ? s->dc_crt_h_total : s->dc_panel_h_total;
572     return (width & 0x00000FFF) + 1;
573 }
574 
575 static inline int get_height(SM501State *s, int crt)
576 {
577     int height = crt ? s->dc_crt_v_total : s->dc_panel_v_total;
578     return (height & 0x00000FFF) + 1;
579 }
580 
581 static inline int get_bpp(SM501State *s, int crt)
582 {
583     int bpp = crt ? s->dc_crt_control : s->dc_panel_control;
584     return 1 << (bpp & 3);
585 }
586 
587 /**
588  * Check the availability of hardware cursor.
589  * @param crt  0 for PANEL, 1 for CRT.
590  */
591 static inline int is_hwc_enabled(SM501State *state, int crt)
592 {
593     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
594     return addr & SM501_HWC_EN;
595 }
596 
597 /**
598  * Get the address which holds cursor pattern data.
599  * @param crt  0 for PANEL, 1 for CRT.
600  */
601 static inline uint8_t *get_hwc_address(SM501State *state, int crt)
602 {
603     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
604     return state->local_mem + (addr & 0x03FFFFF0);
605 }
606 
607 /**
608  * Get the cursor position in y coordinate.
609  * @param crt  0 for PANEL, 1 for CRT.
610  */
611 static inline uint32_t get_hwc_y(SM501State *state, int crt)
612 {
613     uint32_t location = crt ? state->dc_crt_hwc_location
614                             : state->dc_panel_hwc_location;
615     return (location & 0x07FF0000) >> 16;
616 }
617 
618 /**
619  * Get the cursor position in x coordinate.
620  * @param crt  0 for PANEL, 1 for CRT.
621  */
622 static inline uint32_t get_hwc_x(SM501State *state, int crt)
623 {
624     uint32_t location = crt ? state->dc_crt_hwc_location
625                             : state->dc_panel_hwc_location;
626     return location & 0x000007FF;
627 }
628 
629 /**
630  * Get the hardware cursor palette.
631  * @param crt  0 for PANEL, 1 for CRT.
632  * @param palette  pointer to a [3 * 3] array to store color values in
633  */
634 static inline void get_hwc_palette(SM501State *state, int crt, uint8_t *palette)
635 {
636     int i;
637     uint32_t color_reg;
638     uint16_t rgb565;
639 
640     for (i = 0; i < 3; i++) {
641         if (i + 1 == 3) {
642             color_reg = crt ? state->dc_crt_hwc_color_3
643                             : state->dc_panel_hwc_color_3;
644         } else {
645             color_reg = crt ? state->dc_crt_hwc_color_1_2
646                             : state->dc_panel_hwc_color_1_2;
647         }
648 
649         if (i + 1 == 2) {
650             rgb565 = (color_reg >> 16) & 0xFFFF;
651         } else {
652             rgb565 = color_reg & 0xFFFF;
653         }
654         palette[i * 3 + 0] = ((rgb565 >> 11) * 527 + 23) >> 6; /* r */
655         palette[i * 3 + 1] = (((rgb565 >> 5) & 0x3f) * 259 + 33) >> 6; /* g */
656         palette[i * 3 + 2] = ((rgb565 & 0x1f) * 527 + 23) >> 6; /* b */
657     }
658 }
659 
660 static inline void hwc_invalidate(SM501State *s, int crt)
661 {
662     int w = get_width(s, crt);
663     int h = get_height(s, crt);
664     int bpp = get_bpp(s, crt);
665     int start = get_hwc_y(s, crt);
666     int end = MIN(h, start + SM501_HWC_HEIGHT) + 1;
667 
668     start *= w * bpp;
669     end *= w * bpp;
670 
671     memory_region_set_dirty(&s->local_mem_region,
672                             get_fb_addr(s, crt) + start, end - start);
673 }
674 
675 static void sm501_2d_operation(SM501State *s)
676 {
677     int cmd = (s->twoD_control >> 16) & 0x1F;
678     int rtl = s->twoD_control & BIT(27);
679     int format = (s->twoD_stretch >> 20) & 3;
680     int bypp = 1 << format; /* bytes per pixel */
681     int rop_mode = (s->twoD_control >> 15) & 1; /* 1 for rop2, else rop3 */
682     /* 1 if rop2 source is the pattern, otherwise the source is the bitmap */
683     int rop2_source_is_pattern = (s->twoD_control >> 14) & 1;
684     int rop = s->twoD_control & 0xFF;
685     unsigned int dst_x = (s->twoD_destination >> 16) & 0x01FFF;
686     unsigned int dst_y = s->twoD_destination & 0xFFFF;
687     unsigned int width = (s->twoD_dimension >> 16) & 0x1FFF;
688     unsigned int height = s->twoD_dimension & 0xFFFF;
689     uint32_t dst_base = s->twoD_destination_base & 0x03FFFFFF;
690     unsigned int dst_pitch = (s->twoD_pitch >> 16) & 0x1FFF;
691     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
692     int fb_len = get_width(s, crt) * get_height(s, crt) * get_bpp(s, crt);
693     bool overlap = false;
694 
695     if ((s->twoD_stretch >> 16) & 0xF) {
696         qemu_log_mask(LOG_UNIMP, "sm501: only XY addressing is supported.\n");
697         return;
698     }
699 
700     if (s->twoD_source_base & BIT(27) || s->twoD_destination_base & BIT(27)) {
701         qemu_log_mask(LOG_UNIMP, "sm501: only local memory is supported.\n");
702         return;
703     }
704 
705     if (!dst_pitch) {
706         qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero dest pitch.\n");
707         return;
708     }
709 
710     if (!width || !height) {
711         qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero size 2D op.\n");
712         return;
713     }
714 
715     if (rtl) {
716         dst_x -= width - 1;
717         dst_y -= height - 1;
718     }
719 
720     if (dst_base >= get_local_mem_size(s) ||
721         dst_base + (dst_x + width + (dst_y + height) * dst_pitch) * bypp >=
722         get_local_mem_size(s)) {
723         qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
724         return;
725     }
726 
727     switch (cmd) {
728     case 0: /* BitBlt */
729     {
730         static uint32_t tmp_buf[16384];
731         unsigned int src_x = (s->twoD_source >> 16) & 0x01FFF;
732         unsigned int src_y = s->twoD_source & 0xFFFF;
733         uint32_t src_base = s->twoD_source_base & 0x03FFFFFF;
734         unsigned int src_pitch = s->twoD_pitch & 0x1FFF;
735 
736         if (!src_pitch) {
737             qemu_log_mask(LOG_GUEST_ERROR, "sm501: Zero src pitch.\n");
738             return;
739         }
740 
741         if (rtl) {
742             src_x -= width - 1;
743             src_y -= height - 1;
744         }
745 
746         if (src_base >= get_local_mem_size(s) ||
747             src_base + (src_x + width + (src_y + height) * src_pitch) * bypp >=
748             get_local_mem_size(s)) {
749             qemu_log_mask(LOG_GUEST_ERROR,
750                           "sm501: 2D op src is outside vram.\n");
751             return;
752         }
753 
754         if ((rop_mode && rop == 0x5) || (!rop_mode && rop == 0x55)) {
755             /* Invert dest, is there a way to do this with pixman? */
756             unsigned int x, y, i;
757             uint8_t *d = s->local_mem + dst_base;
758 
759             for (y = 0; y < height; y++) {
760                 i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
761                 for (x = 0; x < width; x++, i += bypp) {
762                     stn_he_p(&d[i], bypp, ~ldn_he_p(&d[i], bypp));
763                 }
764             }
765         } else {
766             /* Do copy src for unimplemented ops, better than unpainted area */
767             if ((rop_mode && (rop != 0xc || rop2_source_is_pattern)) ||
768                 (!rop_mode && rop != 0xcc)) {
769                 qemu_log_mask(LOG_UNIMP,
770                               "sm501: rop%d op %x%s not implemented\n",
771                               (rop_mode ? 2 : 3), rop,
772                               (rop2_source_is_pattern ?
773                                   " with pattern source" : ""));
774             }
775             /* Ignore no-op blits, some guests seem to do this */
776             if (src_base == dst_base && src_pitch == dst_pitch &&
777                 src_x == dst_x && src_y == dst_y) {
778                 break;
779             }
780             /* Some clients also do 1 pixel blits, avoid overhead for these */
781             if (width == 1 && height == 1) {
782                 unsigned int si = (src_x + src_y * src_pitch) * bypp;
783                 unsigned int di = (dst_x + dst_y * dst_pitch) * bypp;
784                 stn_he_p(&s->local_mem[dst_base + di], bypp,
785                          ldn_he_p(&s->local_mem[src_base + si], bypp));
786                 break;
787             }
788             /* If reverse blit do simple check for overlaps */
789             if (rtl && src_base == dst_base && src_pitch == dst_pitch) {
790                 overlap = (src_x < dst_x + width && src_x + width > dst_x &&
791                            src_y < dst_y + height && src_y + height > dst_y);
792             } else if (rtl) {
793                 unsigned int sb, se, db, de;
794                 sb = src_base + (src_x + src_y * src_pitch) * bypp;
795                 se = sb + (width + (height - 1) * src_pitch) * bypp;
796                 db = dst_base + (dst_x + dst_y * dst_pitch) * bypp;
797                 de = db + (width + (height - 1) * dst_pitch) * bypp;
798                 overlap = (db < se && sb < de);
799             }
800             if (overlap) {
801                 /* pixman can't do reverse blit: copy via temporary */
802                 int tmp_stride = DIV_ROUND_UP(width * bypp, sizeof(uint32_t));
803                 uint32_t *tmp = tmp_buf;
804 
805                 if (tmp_stride * sizeof(uint32_t) * height > sizeof(tmp_buf)) {
806                     tmp = g_malloc(tmp_stride * sizeof(uint32_t) * height);
807                 }
808                 pixman_blt((uint32_t *)&s->local_mem[src_base], tmp,
809                            src_pitch * bypp / sizeof(uint32_t),
810                            tmp_stride, 8 * bypp, 8 * bypp,
811                            src_x, src_y, 0, 0, width, height);
812                 pixman_blt(tmp, (uint32_t *)&s->local_mem[dst_base],
813                            tmp_stride,
814                            dst_pitch * bypp / sizeof(uint32_t),
815                            8 * bypp, 8 * bypp,
816                            0, 0, dst_x, dst_y, width, height);
817                 if (tmp != tmp_buf) {
818                     g_free(tmp);
819                 }
820             } else {
821                 pixman_blt((uint32_t *)&s->local_mem[src_base],
822                            (uint32_t *)&s->local_mem[dst_base],
823                            src_pitch * bypp / sizeof(uint32_t),
824                            dst_pitch * bypp / sizeof(uint32_t),
825                            8 * bypp, 8 * bypp,
826                            src_x, src_y, dst_x, dst_y, width, height);
827             }
828         }
829         break;
830     }
831     case 1: /* Rectangle Fill */
832     {
833         uint32_t color = s->twoD_foreground;
834 
835         if (format == 2) {
836             color = cpu_to_le32(color);
837         } else if (format == 1) {
838             color = cpu_to_le16(color);
839         }
840 
841         if (width == 1 && height == 1) {
842             unsigned int i = (dst_x + dst_y * dst_pitch) * bypp;
843             stn_he_p(&s->local_mem[dst_base + i], bypp, color);
844         } else {
845             pixman_fill((uint32_t *)&s->local_mem[dst_base],
846                         dst_pitch * bypp / sizeof(uint32_t),
847                         8 * bypp, dst_x, dst_y, width, height, color);
848         }
849         break;
850     }
851     default:
852         qemu_log_mask(LOG_UNIMP, "sm501: not implemented 2D operation: %d\n",
853                       cmd);
854         return;
855     }
856 
857     if (dst_base >= get_fb_addr(s, crt) &&
858         dst_base <= get_fb_addr(s, crt) + fb_len) {
859         int dst_len = MIN(fb_len, ((dst_y + height - 1) * dst_pitch +
860                           dst_x + width) * bypp);
861         if (dst_len) {
862             memory_region_set_dirty(&s->local_mem_region, dst_base, dst_len);
863         }
864     }
865 }
866 
867 static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
868                                          unsigned size)
869 {
870     SM501State *s = (SM501State *)opaque;
871     uint32_t ret = 0;
872 
873     switch (addr) {
874     case SM501_SYSTEM_CONTROL:
875         ret = s->system_control;
876         break;
877     case SM501_MISC_CONTROL:
878         ret = s->misc_control;
879         break;
880     case SM501_GPIO31_0_CONTROL:
881         ret = s->gpio_31_0_control;
882         break;
883     case SM501_GPIO63_32_CONTROL:
884         ret = s->gpio_63_32_control;
885         break;
886     case SM501_DEVICEID:
887         ret = 0x050100A0;
888         break;
889     case SM501_DRAM_CONTROL:
890         ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
891         break;
892     case SM501_ARBTRTN_CONTROL:
893         ret = s->arbitration_control;
894         break;
895     case SM501_COMMAND_LIST_STATUS:
896         ret = 0x00180002; /* FIFOs are empty, everything idle */
897         break;
898     case SM501_IRQ_MASK:
899         ret = s->irq_mask;
900         break;
901     case SM501_MISC_TIMING:
902         /* TODO : simulate gate control */
903         ret = s->misc_timing;
904         break;
905     case SM501_CURRENT_GATE:
906         /* TODO : simulate gate control */
907         ret = 0x00021807;
908         break;
909     case SM501_CURRENT_CLOCK:
910         ret = 0x2A1A0A09;
911         break;
912     case SM501_POWER_MODE_CONTROL:
913         ret = s->power_mode_control;
914         break;
915     case SM501_ENDIAN_CONTROL:
916         ret = 0; /* Only default little endian mode is supported */
917         break;
918 
919     default:
920         qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
921                       "register read. addr=%" HWADDR_PRIx "\n", addr);
922     }
923     trace_sm501_system_config_read(addr, ret);
924     return ret;
925 }
926 
927 static void sm501_system_config_write(void *opaque, hwaddr addr,
928                                       uint64_t value, unsigned size)
929 {
930     SM501State *s = (SM501State *)opaque;
931 
932     trace_sm501_system_config_write((uint32_t)addr, (uint32_t)value);
933     switch (addr) {
934     case SM501_SYSTEM_CONTROL:
935         s->system_control &= 0x10DB0000;
936         s->system_control |= value & 0xEF00B8F7;
937         break;
938     case SM501_MISC_CONTROL:
939         s->misc_control &= 0xEF;
940         s->misc_control |= value & 0xFF7FFF10;
941         break;
942     case SM501_GPIO31_0_CONTROL:
943         s->gpio_31_0_control = value;
944         break;
945     case SM501_GPIO63_32_CONTROL:
946         s->gpio_63_32_control = value & 0xFF80FFFF;
947         break;
948     case SM501_DRAM_CONTROL:
949         s->local_mem_size_index = (value >> 13) & 0x7;
950         /* TODO : check validity of size change */
951         s->dram_control &= 0x80000000;
952         s->dram_control |= value & 0x7FFFFFC3;
953         break;
954     case SM501_ARBTRTN_CONTROL:
955         s->arbitration_control = value & 0x37777777;
956         break;
957     case SM501_IRQ_MASK:
958         s->irq_mask = value & 0xFFDF3F5F;
959         break;
960     case SM501_MISC_TIMING:
961         s->misc_timing = value & 0xF31F1FFF;
962         break;
963     case SM501_POWER_MODE_0_GATE:
964     case SM501_POWER_MODE_1_GATE:
965     case SM501_POWER_MODE_0_CLOCK:
966     case SM501_POWER_MODE_1_CLOCK:
967         /* TODO : simulate gate & clock control */
968         break;
969     case SM501_POWER_MODE_CONTROL:
970         s->power_mode_control = value & 0x00000003;
971         break;
972     case SM501_ENDIAN_CONTROL:
973         if (value & 0x00000001) {
974             qemu_log_mask(LOG_UNIMP, "sm501: system config big endian mode not"
975                           " implemented.\n");
976         }
977         break;
978 
979     default:
980         qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
981                       "register write. addr=%" HWADDR_PRIx
982                       ", val=%" PRIx64 "\n", addr, value);
983     }
984 }
985 
986 static const MemoryRegionOps sm501_system_config_ops = {
987     .read = sm501_system_config_read,
988     .write = sm501_system_config_write,
989     .valid = {
990         .min_access_size = 4,
991         .max_access_size = 4,
992     },
993     .endianness = DEVICE_LITTLE_ENDIAN,
994 };
995 
996 static uint64_t sm501_i2c_read(void *opaque, hwaddr addr, unsigned size)
997 {
998     SM501State *s = (SM501State *)opaque;
999     uint8_t ret = 0;
1000 
1001     switch (addr) {
1002     case SM501_I2C_BYTE_COUNT:
1003         ret = s->i2c_byte_count;
1004         break;
1005     case SM501_I2C_STATUS:
1006         ret = s->i2c_status;
1007         break;
1008     case SM501_I2C_SLAVE_ADDRESS:
1009         ret = s->i2c_addr;
1010         break;
1011     case SM501_I2C_DATA ... SM501_I2C_DATA + 15:
1012         ret = s->i2c_data[addr - SM501_I2C_DATA];
1013         break;
1014     default:
1015         qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register read."
1016                       " addr=0x%" HWADDR_PRIx "\n", addr);
1017     }
1018     trace_sm501_i2c_read((uint32_t)addr, ret);
1019     return ret;
1020 }
1021 
1022 static void sm501_i2c_write(void *opaque, hwaddr addr, uint64_t value,
1023                             unsigned size)
1024 {
1025     SM501State *s = (SM501State *)opaque;
1026 
1027     trace_sm501_i2c_write((uint32_t)addr, (uint32_t)value);
1028     switch (addr) {
1029     case SM501_I2C_BYTE_COUNT:
1030         s->i2c_byte_count = value & 0xf;
1031         break;
1032     case SM501_I2C_CONTROL:
1033         if (value & SM501_I2C_CONTROL_ENABLE) {
1034             if (value & SM501_I2C_CONTROL_START) {
1035                 int res = i2c_start_transfer(s->i2c_bus,
1036                                              s->i2c_addr >> 1,
1037                                              s->i2c_addr & 1);
1038                 s->i2c_status |= (res ? SM501_I2C_STATUS_ERROR : 0);
1039                 if (!res) {
1040                     int i;
1041                     for (i = 0; i <= s->i2c_byte_count; i++) {
1042                         res = i2c_send_recv(s->i2c_bus, &s->i2c_data[i],
1043                                             !(s->i2c_addr & 1));
1044                         if (res) {
1045                             s->i2c_status |= SM501_I2C_STATUS_ERROR;
1046                             return;
1047                         }
1048                     }
1049                     if (i) {
1050                         s->i2c_status = SM501_I2C_STATUS_COMPLETE;
1051                     }
1052                 }
1053             } else {
1054                 i2c_end_transfer(s->i2c_bus);
1055                 s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
1056             }
1057         }
1058         break;
1059     case SM501_I2C_RESET:
1060         if ((value & SM501_I2C_RESET_ERROR) == 0) {
1061             s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
1062         }
1063         break;
1064     case SM501_I2C_SLAVE_ADDRESS:
1065         s->i2c_addr = value & 0xff;
1066         break;
1067     case SM501_I2C_DATA ... SM501_I2C_DATA + 15:
1068         s->i2c_data[addr - SM501_I2C_DATA] = value & 0xff;
1069         break;
1070     default:
1071         qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register write. "
1072                       "addr=0x%" HWADDR_PRIx " val=%" PRIx64 "\n", addr, value);
1073     }
1074 }
1075 
1076 static const MemoryRegionOps sm501_i2c_ops = {
1077     .read = sm501_i2c_read,
1078     .write = sm501_i2c_write,
1079     .valid = {
1080         .min_access_size = 1,
1081         .max_access_size = 1,
1082     },
1083     .impl = {
1084         .min_access_size = 1,
1085         .max_access_size = 1,
1086     },
1087     .endianness = DEVICE_LITTLE_ENDIAN,
1088 };
1089 
1090 static uint32_t sm501_palette_read(void *opaque, hwaddr addr)
1091 {
1092     SM501State *s = (SM501State *)opaque;
1093 
1094     trace_sm501_palette_read((uint32_t)addr);
1095 
1096     /* TODO : consider BYTE/WORD access */
1097     /* TODO : consider endian */
1098 
1099     assert(range_covers_byte(0, 0x400 * 3, addr));
1100     return *(uint32_t *)&s->dc_palette[addr];
1101 }
1102 
1103 static void sm501_palette_write(void *opaque, hwaddr addr,
1104                                 uint32_t value)
1105 {
1106     SM501State *s = (SM501State *)opaque;
1107 
1108     trace_sm501_palette_write((uint32_t)addr, value);
1109 
1110     /* TODO : consider BYTE/WORD access */
1111     /* TODO : consider endian */
1112 
1113     assert(range_covers_byte(0, 0x400 * 3, addr));
1114     *(uint32_t *)&s->dc_palette[addr] = value;
1115     s->do_full_update = true;
1116 }
1117 
1118 static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr addr,
1119                                      unsigned size)
1120 {
1121     SM501State *s = (SM501State *)opaque;
1122     uint32_t ret = 0;
1123 
1124     switch (addr) {
1125 
1126     case SM501_DC_PANEL_CONTROL:
1127         ret = s->dc_panel_control;
1128         break;
1129     case SM501_DC_PANEL_PANNING_CONTROL:
1130         ret = s->dc_panel_panning_control;
1131         break;
1132     case SM501_DC_PANEL_COLOR_KEY:
1133         /* Not implemented yet */
1134         break;
1135     case SM501_DC_PANEL_FB_ADDR:
1136         ret = s->dc_panel_fb_addr;
1137         break;
1138     case SM501_DC_PANEL_FB_OFFSET:
1139         ret = s->dc_panel_fb_offset;
1140         break;
1141     case SM501_DC_PANEL_FB_WIDTH:
1142         ret = s->dc_panel_fb_width;
1143         break;
1144     case SM501_DC_PANEL_FB_HEIGHT:
1145         ret = s->dc_panel_fb_height;
1146         break;
1147     case SM501_DC_PANEL_TL_LOC:
1148         ret = s->dc_panel_tl_location;
1149         break;
1150     case SM501_DC_PANEL_BR_LOC:
1151         ret = s->dc_panel_br_location;
1152         break;
1153 
1154     case SM501_DC_PANEL_H_TOT:
1155         ret = s->dc_panel_h_total;
1156         break;
1157     case SM501_DC_PANEL_H_SYNC:
1158         ret = s->dc_panel_h_sync;
1159         break;
1160     case SM501_DC_PANEL_V_TOT:
1161         ret = s->dc_panel_v_total;
1162         break;
1163     case SM501_DC_PANEL_V_SYNC:
1164         ret = s->dc_panel_v_sync;
1165         break;
1166 
1167     case SM501_DC_PANEL_HWC_ADDR:
1168         ret = s->dc_panel_hwc_addr;
1169         break;
1170     case SM501_DC_PANEL_HWC_LOC:
1171         ret = s->dc_panel_hwc_location;
1172         break;
1173     case SM501_DC_PANEL_HWC_COLOR_1_2:
1174         ret = s->dc_panel_hwc_color_1_2;
1175         break;
1176     case SM501_DC_PANEL_HWC_COLOR_3:
1177         ret = s->dc_panel_hwc_color_3;
1178         break;
1179 
1180     case SM501_DC_VIDEO_CONTROL:
1181         ret = s->dc_video_control;
1182         break;
1183 
1184     case SM501_DC_CRT_CONTROL:
1185         ret = s->dc_crt_control;
1186         break;
1187     case SM501_DC_CRT_FB_ADDR:
1188         ret = s->dc_crt_fb_addr;
1189         break;
1190     case SM501_DC_CRT_FB_OFFSET:
1191         ret = s->dc_crt_fb_offset;
1192         break;
1193     case SM501_DC_CRT_H_TOT:
1194         ret = s->dc_crt_h_total;
1195         break;
1196     case SM501_DC_CRT_H_SYNC:
1197         ret = s->dc_crt_h_sync;
1198         break;
1199     case SM501_DC_CRT_V_TOT:
1200         ret = s->dc_crt_v_total;
1201         break;
1202     case SM501_DC_CRT_V_SYNC:
1203         ret = s->dc_crt_v_sync;
1204         break;
1205 
1206     case SM501_DC_CRT_HWC_ADDR:
1207         ret = s->dc_crt_hwc_addr;
1208         break;
1209     case SM501_DC_CRT_HWC_LOC:
1210         ret = s->dc_crt_hwc_location;
1211         break;
1212     case SM501_DC_CRT_HWC_COLOR_1_2:
1213         ret = s->dc_crt_hwc_color_1_2;
1214         break;
1215     case SM501_DC_CRT_HWC_COLOR_3:
1216         ret = s->dc_crt_hwc_color_3;
1217         break;
1218 
1219     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1220         ret = sm501_palette_read(opaque, addr - SM501_DC_PANEL_PALETTE);
1221         break;
1222 
1223     default:
1224         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1225                       "read. addr=%" HWADDR_PRIx "\n", addr);
1226     }
1227     trace_sm501_disp_ctrl_read((uint32_t)addr, ret);
1228     return ret;
1229 }
1230 
1231 static void sm501_disp_ctrl_write(void *opaque, hwaddr addr,
1232                                   uint64_t value, unsigned size)
1233 {
1234     SM501State *s = (SM501State *)opaque;
1235 
1236     trace_sm501_disp_ctrl_write((uint32_t)addr, (uint32_t)value);
1237     switch (addr) {
1238     case SM501_DC_PANEL_CONTROL:
1239         s->dc_panel_control = value & 0x0FFF73FF;
1240         break;
1241     case SM501_DC_PANEL_PANNING_CONTROL:
1242         s->dc_panel_panning_control = value & 0xFF3FFF3F;
1243         break;
1244     case SM501_DC_PANEL_COLOR_KEY:
1245         /* Not implemented yet */
1246         break;
1247     case SM501_DC_PANEL_FB_ADDR:
1248         s->dc_panel_fb_addr = value & 0x8FFFFFF0;
1249         if (value & 0x8000000) {
1250             qemu_log_mask(LOG_UNIMP, "Panel external memory not supported\n");
1251         }
1252         s->do_full_update = true;
1253         break;
1254     case SM501_DC_PANEL_FB_OFFSET:
1255         s->dc_panel_fb_offset = value & 0x3FF03FF0;
1256         break;
1257     case SM501_DC_PANEL_FB_WIDTH:
1258         s->dc_panel_fb_width = value & 0x0FFF0FFF;
1259         break;
1260     case SM501_DC_PANEL_FB_HEIGHT:
1261         s->dc_panel_fb_height = value & 0x0FFF0FFF;
1262         break;
1263     case SM501_DC_PANEL_TL_LOC:
1264         s->dc_panel_tl_location = value & 0x07FF07FF;
1265         break;
1266     case SM501_DC_PANEL_BR_LOC:
1267         s->dc_panel_br_location = value & 0x07FF07FF;
1268         break;
1269 
1270     case SM501_DC_PANEL_H_TOT:
1271         s->dc_panel_h_total = value & 0x0FFF0FFF;
1272         break;
1273     case SM501_DC_PANEL_H_SYNC:
1274         s->dc_panel_h_sync = value & 0x00FF0FFF;
1275         break;
1276     case SM501_DC_PANEL_V_TOT:
1277         s->dc_panel_v_total = value & 0x0FFF0FFF;
1278         break;
1279     case SM501_DC_PANEL_V_SYNC:
1280         s->dc_panel_v_sync = value & 0x003F0FFF;
1281         break;
1282 
1283     case SM501_DC_PANEL_HWC_ADDR:
1284         value &= 0x8FFFFFF0;
1285         if (value != s->dc_panel_hwc_addr) {
1286             hwc_invalidate(s, 0);
1287             s->dc_panel_hwc_addr = value;
1288         }
1289         break;
1290     case SM501_DC_PANEL_HWC_LOC:
1291         value &= 0x0FFF0FFF;
1292         if (value != s->dc_panel_hwc_location) {
1293             hwc_invalidate(s, 0);
1294             s->dc_panel_hwc_location = value;
1295         }
1296         break;
1297     case SM501_DC_PANEL_HWC_COLOR_1_2:
1298         s->dc_panel_hwc_color_1_2 = value;
1299         break;
1300     case SM501_DC_PANEL_HWC_COLOR_3:
1301         s->dc_panel_hwc_color_3 = value & 0x0000FFFF;
1302         break;
1303 
1304     case SM501_DC_VIDEO_CONTROL:
1305         s->dc_video_control = value & 0x00037FFF;
1306         break;
1307 
1308     case SM501_DC_CRT_CONTROL:
1309         s->dc_crt_control = value & 0x0003FFFF;
1310         break;
1311     case SM501_DC_CRT_FB_ADDR:
1312         s->dc_crt_fb_addr = value & 0x8FFFFFF0;
1313         if (value & 0x8000000) {
1314             qemu_log_mask(LOG_UNIMP, "CRT external memory not supported\n");
1315         }
1316         s->do_full_update = true;
1317         break;
1318     case SM501_DC_CRT_FB_OFFSET:
1319         s->dc_crt_fb_offset = value & 0x3FF03FF0;
1320         break;
1321     case SM501_DC_CRT_H_TOT:
1322         s->dc_crt_h_total = value & 0x0FFF0FFF;
1323         break;
1324     case SM501_DC_CRT_H_SYNC:
1325         s->dc_crt_h_sync = value & 0x00FF0FFF;
1326         break;
1327     case SM501_DC_CRT_V_TOT:
1328         s->dc_crt_v_total = value & 0x0FFF0FFF;
1329         break;
1330     case SM501_DC_CRT_V_SYNC:
1331         s->dc_crt_v_sync = value & 0x003F0FFF;
1332         break;
1333 
1334     case SM501_DC_CRT_HWC_ADDR:
1335         value &= 0x8FFFFFF0;
1336         if (value != s->dc_crt_hwc_addr) {
1337             hwc_invalidate(s, 1);
1338             s->dc_crt_hwc_addr = value;
1339         }
1340         break;
1341     case SM501_DC_CRT_HWC_LOC:
1342         value &= 0x0FFF0FFF;
1343         if (value != s->dc_crt_hwc_location) {
1344             hwc_invalidate(s, 1);
1345             s->dc_crt_hwc_location = value;
1346         }
1347         break;
1348     case SM501_DC_CRT_HWC_COLOR_1_2:
1349         s->dc_crt_hwc_color_1_2 = value;
1350         break;
1351     case SM501_DC_CRT_HWC_COLOR_3:
1352         s->dc_crt_hwc_color_3 = value & 0x0000FFFF;
1353         break;
1354 
1355     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1356         sm501_palette_write(opaque, addr - SM501_DC_PANEL_PALETTE, value);
1357         break;
1358 
1359     default:
1360         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1361                       "write. addr=%" HWADDR_PRIx
1362                       ", val=%" PRIx64 "\n", addr, value);
1363     }
1364 }
1365 
1366 static const MemoryRegionOps sm501_disp_ctrl_ops = {
1367     .read = sm501_disp_ctrl_read,
1368     .write = sm501_disp_ctrl_write,
1369     .valid = {
1370         .min_access_size = 4,
1371         .max_access_size = 4,
1372     },
1373     .endianness = DEVICE_LITTLE_ENDIAN,
1374 };
1375 
1376 static uint64_t sm501_2d_engine_read(void *opaque, hwaddr addr,
1377                                      unsigned size)
1378 {
1379     SM501State *s = (SM501State *)opaque;
1380     uint32_t ret = 0;
1381 
1382     switch (addr) {
1383     case SM501_2D_SOURCE:
1384         ret = s->twoD_source;
1385         break;
1386     case SM501_2D_DESTINATION:
1387         ret = s->twoD_destination;
1388         break;
1389     case SM501_2D_DIMENSION:
1390         ret = s->twoD_dimension;
1391         break;
1392     case SM501_2D_CONTROL:
1393         ret = s->twoD_control;
1394         break;
1395     case SM501_2D_PITCH:
1396         ret = s->twoD_pitch;
1397         break;
1398     case SM501_2D_FOREGROUND:
1399         ret = s->twoD_foreground;
1400         break;
1401     case SM501_2D_BACKGROUND:
1402         ret = s->twoD_background;
1403         break;
1404     case SM501_2D_STRETCH:
1405         ret = s->twoD_stretch;
1406         break;
1407     case SM501_2D_COLOR_COMPARE:
1408         ret = s->twoD_color_compare;
1409         break;
1410     case SM501_2D_COLOR_COMPARE_MASK:
1411         ret = s->twoD_color_compare_mask;
1412         break;
1413     case SM501_2D_MASK:
1414         ret = s->twoD_mask;
1415         break;
1416     case SM501_2D_CLIP_TL:
1417         ret = s->twoD_clip_tl;
1418         break;
1419     case SM501_2D_CLIP_BR:
1420         ret = s->twoD_clip_br;
1421         break;
1422     case SM501_2D_MONO_PATTERN_LOW:
1423         ret = s->twoD_mono_pattern_low;
1424         break;
1425     case SM501_2D_MONO_PATTERN_HIGH:
1426         ret = s->twoD_mono_pattern_high;
1427         break;
1428     case SM501_2D_WINDOW_WIDTH:
1429         ret = s->twoD_window_width;
1430         break;
1431     case SM501_2D_SOURCE_BASE:
1432         ret = s->twoD_source_base;
1433         break;
1434     case SM501_2D_DESTINATION_BASE:
1435         ret = s->twoD_destination_base;
1436         break;
1437     case SM501_2D_ALPHA:
1438         ret = s->twoD_alpha;
1439         break;
1440     case SM501_2D_WRAP:
1441         ret = s->twoD_wrap;
1442         break;
1443     case SM501_2D_STATUS:
1444         ret = 0; /* Should return interrupt status */
1445         break;
1446     default:
1447         qemu_log_mask(LOG_UNIMP, "sm501: not implemented disp ctrl register "
1448                       "read. addr=%" HWADDR_PRIx "\n", addr);
1449     }
1450     trace_sm501_2d_engine_read((uint32_t)addr, ret);
1451     return ret;
1452 }
1453 
1454 static void sm501_2d_engine_write(void *opaque, hwaddr addr,
1455                                   uint64_t value, unsigned size)
1456 {
1457     SM501State *s = (SM501State *)opaque;
1458 
1459     trace_sm501_2d_engine_write((uint32_t)addr, (uint32_t)value);
1460     switch (addr) {
1461     case SM501_2D_SOURCE:
1462         s->twoD_source = value;
1463         break;
1464     case SM501_2D_DESTINATION:
1465         s->twoD_destination = value;
1466         break;
1467     case SM501_2D_DIMENSION:
1468         s->twoD_dimension = value;
1469         break;
1470     case SM501_2D_CONTROL:
1471         s->twoD_control = value;
1472 
1473         /* do 2d operation if start flag is set. */
1474         if (value & 0x80000000) {
1475             sm501_2d_operation(s);
1476             s->twoD_control &= ~0x80000000; /* start flag down */
1477         }
1478 
1479         break;
1480     case SM501_2D_PITCH:
1481         s->twoD_pitch = value;
1482         break;
1483     case SM501_2D_FOREGROUND:
1484         s->twoD_foreground = value;
1485         break;
1486     case SM501_2D_BACKGROUND:
1487         s->twoD_background = value;
1488         break;
1489     case SM501_2D_STRETCH:
1490         if (((value >> 20) & 3) == 3) {
1491             value &= ~BIT(20);
1492         }
1493         s->twoD_stretch = value;
1494         break;
1495     case SM501_2D_COLOR_COMPARE:
1496         s->twoD_color_compare = value;
1497         break;
1498     case SM501_2D_COLOR_COMPARE_MASK:
1499         s->twoD_color_compare_mask = value;
1500         break;
1501     case SM501_2D_MASK:
1502         s->twoD_mask = value;
1503         break;
1504     case SM501_2D_CLIP_TL:
1505         s->twoD_clip_tl = value;
1506         break;
1507     case SM501_2D_CLIP_BR:
1508         s->twoD_clip_br = value;
1509         break;
1510     case SM501_2D_MONO_PATTERN_LOW:
1511         s->twoD_mono_pattern_low = value;
1512         break;
1513     case SM501_2D_MONO_PATTERN_HIGH:
1514         s->twoD_mono_pattern_high = value;
1515         break;
1516     case SM501_2D_WINDOW_WIDTH:
1517         s->twoD_window_width = value;
1518         break;
1519     case SM501_2D_SOURCE_BASE:
1520         s->twoD_source_base = value;
1521         break;
1522     case SM501_2D_DESTINATION_BASE:
1523         s->twoD_destination_base = value;
1524         break;
1525     case SM501_2D_ALPHA:
1526         s->twoD_alpha = value;
1527         break;
1528     case SM501_2D_WRAP:
1529         s->twoD_wrap = value;
1530         break;
1531     case SM501_2D_STATUS:
1532         /* ignored, writing 0 should clear interrupt status */
1533         break;
1534     default:
1535         qemu_log_mask(LOG_UNIMP, "sm501: not implemented 2d engine register "
1536                       "write. addr=%" HWADDR_PRIx
1537                       ", val=%" PRIx64 "\n", addr, value);
1538     }
1539 }
1540 
1541 static const MemoryRegionOps sm501_2d_engine_ops = {
1542     .read = sm501_2d_engine_read,
1543     .write = sm501_2d_engine_write,
1544     .valid = {
1545         .min_access_size = 4,
1546         .max_access_size = 4,
1547     },
1548     .endianness = DEVICE_LITTLE_ENDIAN,
1549 };
1550 
1551 /* draw line functions for all console modes */
1552 
1553 typedef void draw_line_func(uint8_t *d, const uint8_t *s,
1554                             int width, const uint32_t *pal);
1555 
1556 typedef void draw_hwc_line_func(uint8_t *d, const uint8_t *s,
1557                                 int width, const uint8_t *palette,
1558                                 int c_x, int c_y);
1559 
1560 #define DEPTH 8
1561 #include "sm501_template.h"
1562 
1563 #define DEPTH 15
1564 #include "sm501_template.h"
1565 
1566 #define BGR_FORMAT
1567 #define DEPTH 15
1568 #include "sm501_template.h"
1569 
1570 #define DEPTH 16
1571 #include "sm501_template.h"
1572 
1573 #define BGR_FORMAT
1574 #define DEPTH 16
1575 #include "sm501_template.h"
1576 
1577 #define DEPTH 32
1578 #include "sm501_template.h"
1579 
1580 #define BGR_FORMAT
1581 #define DEPTH 32
1582 #include "sm501_template.h"
1583 
1584 static draw_line_func *draw_line8_funcs[] = {
1585     draw_line8_8,
1586     draw_line8_15,
1587     draw_line8_16,
1588     draw_line8_32,
1589     draw_line8_32bgr,
1590     draw_line8_15bgr,
1591     draw_line8_16bgr,
1592 };
1593 
1594 static draw_line_func *draw_line16_funcs[] = {
1595     draw_line16_8,
1596     draw_line16_15,
1597     draw_line16_16,
1598     draw_line16_32,
1599     draw_line16_32bgr,
1600     draw_line16_15bgr,
1601     draw_line16_16bgr,
1602 };
1603 
1604 static draw_line_func *draw_line32_funcs[] = {
1605     draw_line32_8,
1606     draw_line32_15,
1607     draw_line32_16,
1608     draw_line32_32,
1609     draw_line32_32bgr,
1610     draw_line32_15bgr,
1611     draw_line32_16bgr,
1612 };
1613 
1614 static draw_hwc_line_func *draw_hwc_line_funcs[] = {
1615     draw_hwc_line_8,
1616     draw_hwc_line_15,
1617     draw_hwc_line_16,
1618     draw_hwc_line_32,
1619     draw_hwc_line_32bgr,
1620     draw_hwc_line_15bgr,
1621     draw_hwc_line_16bgr,
1622 };
1623 
1624 static inline int get_depth_index(DisplaySurface *surface)
1625 {
1626     switch (surface_bits_per_pixel(surface)) {
1627     default:
1628     case 8:
1629         return 0;
1630     case 15:
1631         return 1;
1632     case 16:
1633         return 2;
1634     case 32:
1635         if (is_surface_bgr(surface)) {
1636             return 4;
1637         } else {
1638             return 3;
1639         }
1640     }
1641 }
1642 
1643 static void sm501_update_display(void *opaque)
1644 {
1645     SM501State *s = (SM501State *)opaque;
1646     DisplaySurface *surface = qemu_console_surface(s->con);
1647     DirtyBitmapSnapshot *snap;
1648     int y, c_x = 0, c_y = 0;
1649     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
1650     int width = get_width(s, crt);
1651     int height = get_height(s, crt);
1652     int src_bpp = get_bpp(s, crt);
1653     int dst_bpp = surface_bytes_per_pixel(surface);
1654     int dst_depth_index = get_depth_index(surface);
1655     draw_line_func *draw_line = NULL;
1656     draw_hwc_line_func *draw_hwc_line = NULL;
1657     int full_update = 0;
1658     int y_start = -1;
1659     ram_addr_t offset;
1660     uint32_t *palette;
1661     uint8_t hwc_palette[3 * 3];
1662     uint8_t *hwc_src = NULL;
1663 
1664     if (!((crt ? s->dc_crt_control : s->dc_panel_control)
1665           & SM501_DC_CRT_CONTROL_ENABLE)) {
1666         return;
1667     }
1668 
1669     palette = (uint32_t *)(crt ? &s->dc_palette[SM501_DC_CRT_PALETTE -
1670                                                 SM501_DC_PANEL_PALETTE]
1671                                : &s->dc_palette[0]);
1672 
1673     /* choose draw_line function */
1674     switch (src_bpp) {
1675     case 1:
1676         draw_line = draw_line8_funcs[dst_depth_index];
1677         break;
1678     case 2:
1679         draw_line = draw_line16_funcs[dst_depth_index];
1680         break;
1681     case 4:
1682         draw_line = draw_line32_funcs[dst_depth_index];
1683         break;
1684     default:
1685         qemu_log_mask(LOG_GUEST_ERROR, "sm501: update display"
1686                       "invalid control register value.\n");
1687         return;
1688     }
1689 
1690     /* set up to draw hardware cursor */
1691     if (is_hwc_enabled(s, crt)) {
1692         /* choose cursor draw line function */
1693         draw_hwc_line = draw_hwc_line_funcs[dst_depth_index];
1694         hwc_src = get_hwc_address(s, crt);
1695         c_x = get_hwc_x(s, crt);
1696         c_y = get_hwc_y(s, crt);
1697         get_hwc_palette(s, crt, hwc_palette);
1698     }
1699 
1700     /* adjust console size */
1701     if (s->last_width != width || s->last_height != height) {
1702         qemu_console_resize(s->con, width, height);
1703         surface = qemu_console_surface(s->con);
1704         s->last_width = width;
1705         s->last_height = height;
1706         full_update = 1;
1707     }
1708 
1709     /* someone else requested a full update */
1710     if (s->do_full_update) {
1711         s->do_full_update = false;
1712         full_update = 1;
1713     }
1714 
1715     /* draw each line according to conditions */
1716     offset = get_fb_addr(s, crt);
1717     snap = memory_region_snapshot_and_clear_dirty(&s->local_mem_region,
1718               offset, width * height * src_bpp, DIRTY_MEMORY_VGA);
1719     for (y = 0; y < height; y++, offset += width * src_bpp) {
1720         int update, update_hwc;
1721 
1722         /* check if hardware cursor is enabled and we're within its range */
1723         update_hwc = draw_hwc_line && c_y <= y && y < c_y + SM501_HWC_HEIGHT;
1724         update = full_update || update_hwc;
1725         /* check dirty flags for each line */
1726         update |= memory_region_snapshot_get_dirty(&s->local_mem_region, snap,
1727                                                    offset, width * src_bpp);
1728 
1729         /* draw line and change status */
1730         if (update) {
1731             uint8_t *d = surface_data(surface);
1732             d +=  y * width * dst_bpp;
1733 
1734             /* draw graphics layer */
1735             draw_line(d, s->local_mem + offset, width, palette);
1736 
1737             /* draw hardware cursor */
1738             if (update_hwc) {
1739                 draw_hwc_line(d, hwc_src, width, hwc_palette, c_x, y - c_y);
1740             }
1741 
1742             if (y_start < 0) {
1743                 y_start = y;
1744             }
1745         } else {
1746             if (y_start >= 0) {
1747                 /* flush to display */
1748                 dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1749                 y_start = -1;
1750             }
1751         }
1752     }
1753     g_free(snap);
1754 
1755     /* complete flush to display */
1756     if (y_start >= 0) {
1757         dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1758     }
1759 }
1760 
1761 static const GraphicHwOps sm501_ops = {
1762     .gfx_update  = sm501_update_display,
1763 };
1764 
1765 static void sm501_reset(SM501State *s)
1766 {
1767     s->system_control = 0x00100000; /* 2D engine FIFO empty */
1768     /* Bits 17 (SH), 7 (CDR), 6:5 (Test), 2:0 (Bus) are all supposed
1769      * to be determined at reset by GPIO lines which set config bits.
1770      * We hardwire them:
1771      *  SH = 0 : Hitachi Ready Polarity == Active Low
1772      *  CDR = 0 : do not reset clock divider
1773      *  TEST = 0 : Normal mode (not testing the silicon)
1774      *  BUS = 0 : Hitachi SH3/SH4
1775      */
1776     s->misc_control = SM501_MISC_DAC_POWER;
1777     s->gpio_31_0_control = 0;
1778     s->gpio_63_32_control = 0;
1779     s->dram_control = 0;
1780     s->arbitration_control = 0x05146732;
1781     s->irq_mask = 0;
1782     s->misc_timing = 0;
1783     s->power_mode_control = 0;
1784     s->i2c_byte_count = 0;
1785     s->i2c_status = 0;
1786     s->i2c_addr = 0;
1787     memset(s->i2c_data, 0, 16);
1788     s->dc_panel_control = 0x00010000; /* FIFO level 3 */
1789     s->dc_video_control = 0;
1790     s->dc_crt_control = 0x00010000;
1791     s->twoD_source = 0;
1792     s->twoD_destination = 0;
1793     s->twoD_dimension = 0;
1794     s->twoD_control = 0;
1795     s->twoD_pitch = 0;
1796     s->twoD_foreground = 0;
1797     s->twoD_background = 0;
1798     s->twoD_stretch = 0;
1799     s->twoD_color_compare = 0;
1800     s->twoD_color_compare_mask = 0;
1801     s->twoD_mask = 0;
1802     s->twoD_clip_tl = 0;
1803     s->twoD_clip_br = 0;
1804     s->twoD_mono_pattern_low = 0;
1805     s->twoD_mono_pattern_high = 0;
1806     s->twoD_window_width = 0;
1807     s->twoD_source_base = 0;
1808     s->twoD_destination_base = 0;
1809     s->twoD_alpha = 0;
1810     s->twoD_wrap = 0;
1811 }
1812 
1813 static void sm501_init(SM501State *s, DeviceState *dev,
1814                        uint32_t local_mem_bytes)
1815 {
1816     s->local_mem_size_index = get_local_mem_size_index(local_mem_bytes);
1817 
1818     /* local memory */
1819     memory_region_init_ram(&s->local_mem_region, OBJECT(dev), "sm501.local",
1820                            get_local_mem_size(s), &error_fatal);
1821     memory_region_set_log(&s->local_mem_region, true, DIRTY_MEMORY_VGA);
1822     s->local_mem = memory_region_get_ram_ptr(&s->local_mem_region);
1823 
1824     /* i2c */
1825     s->i2c_bus = i2c_init_bus(dev, "sm501.i2c");
1826     /* ddc */
1827     I2CDDCState *ddc = I2CDDC(qdev_new(TYPE_I2CDDC));
1828     i2c_set_slave_address(I2C_SLAVE(ddc), 0x50);
1829     qdev_realize_and_unref(DEVICE(ddc), BUS(s->i2c_bus), &error_abort);
1830 
1831     /* mmio */
1832     memory_region_init(&s->mmio_region, OBJECT(dev), "sm501.mmio", MMIO_SIZE);
1833     memory_region_init_io(&s->system_config_region, OBJECT(dev),
1834                           &sm501_system_config_ops, s,
1835                           "sm501-system-config", 0x6c);
1836     memory_region_add_subregion(&s->mmio_region, SM501_SYS_CONFIG,
1837                                 &s->system_config_region);
1838     memory_region_init_io(&s->i2c_region, OBJECT(dev), &sm501_i2c_ops, s,
1839                           "sm501-i2c", 0x14);
1840     memory_region_add_subregion(&s->mmio_region, SM501_I2C, &s->i2c_region);
1841     memory_region_init_io(&s->disp_ctrl_region, OBJECT(dev),
1842                           &sm501_disp_ctrl_ops, s,
1843                           "sm501-disp-ctrl", 0x1000);
1844     memory_region_add_subregion(&s->mmio_region, SM501_DC,
1845                                 &s->disp_ctrl_region);
1846     memory_region_init_io(&s->twoD_engine_region, OBJECT(dev),
1847                           &sm501_2d_engine_ops, s,
1848                           "sm501-2d-engine", 0x54);
1849     memory_region_add_subregion(&s->mmio_region, SM501_2D_ENGINE,
1850                                 &s->twoD_engine_region);
1851 
1852     /* create qemu graphic console */
1853     s->con = graphic_console_init(dev, 0, &sm501_ops, s);
1854 }
1855 
1856 static const VMStateDescription vmstate_sm501_state = {
1857     .name = "sm501-state",
1858     .version_id = 1,
1859     .minimum_version_id = 1,
1860     .fields = (VMStateField[]) {
1861         VMSTATE_UINT32(local_mem_size_index, SM501State),
1862         VMSTATE_UINT32(system_control, SM501State),
1863         VMSTATE_UINT32(misc_control, SM501State),
1864         VMSTATE_UINT32(gpio_31_0_control, SM501State),
1865         VMSTATE_UINT32(gpio_63_32_control, SM501State),
1866         VMSTATE_UINT32(dram_control, SM501State),
1867         VMSTATE_UINT32(arbitration_control, SM501State),
1868         VMSTATE_UINT32(irq_mask, SM501State),
1869         VMSTATE_UINT32(misc_timing, SM501State),
1870         VMSTATE_UINT32(power_mode_control, SM501State),
1871         VMSTATE_UINT32(uart0_ier, SM501State),
1872         VMSTATE_UINT32(uart0_lcr, SM501State),
1873         VMSTATE_UINT32(uart0_mcr, SM501State),
1874         VMSTATE_UINT32(uart0_scr, SM501State),
1875         VMSTATE_UINT8_ARRAY(dc_palette, SM501State, DC_PALETTE_ENTRIES),
1876         VMSTATE_UINT32(dc_panel_control, SM501State),
1877         VMSTATE_UINT32(dc_panel_panning_control, SM501State),
1878         VMSTATE_UINT32(dc_panel_fb_addr, SM501State),
1879         VMSTATE_UINT32(dc_panel_fb_offset, SM501State),
1880         VMSTATE_UINT32(dc_panel_fb_width, SM501State),
1881         VMSTATE_UINT32(dc_panel_fb_height, SM501State),
1882         VMSTATE_UINT32(dc_panel_tl_location, SM501State),
1883         VMSTATE_UINT32(dc_panel_br_location, SM501State),
1884         VMSTATE_UINT32(dc_panel_h_total, SM501State),
1885         VMSTATE_UINT32(dc_panel_h_sync, SM501State),
1886         VMSTATE_UINT32(dc_panel_v_total, SM501State),
1887         VMSTATE_UINT32(dc_panel_v_sync, SM501State),
1888         VMSTATE_UINT32(dc_panel_hwc_addr, SM501State),
1889         VMSTATE_UINT32(dc_panel_hwc_location, SM501State),
1890         VMSTATE_UINT32(dc_panel_hwc_color_1_2, SM501State),
1891         VMSTATE_UINT32(dc_panel_hwc_color_3, SM501State),
1892         VMSTATE_UINT32(dc_video_control, SM501State),
1893         VMSTATE_UINT32(dc_crt_control, SM501State),
1894         VMSTATE_UINT32(dc_crt_fb_addr, SM501State),
1895         VMSTATE_UINT32(dc_crt_fb_offset, SM501State),
1896         VMSTATE_UINT32(dc_crt_h_total, SM501State),
1897         VMSTATE_UINT32(dc_crt_h_sync, SM501State),
1898         VMSTATE_UINT32(dc_crt_v_total, SM501State),
1899         VMSTATE_UINT32(dc_crt_v_sync, SM501State),
1900         VMSTATE_UINT32(dc_crt_hwc_addr, SM501State),
1901         VMSTATE_UINT32(dc_crt_hwc_location, SM501State),
1902         VMSTATE_UINT32(dc_crt_hwc_color_1_2, SM501State),
1903         VMSTATE_UINT32(dc_crt_hwc_color_3, SM501State),
1904         VMSTATE_UINT32(twoD_source, SM501State),
1905         VMSTATE_UINT32(twoD_destination, SM501State),
1906         VMSTATE_UINT32(twoD_dimension, SM501State),
1907         VMSTATE_UINT32(twoD_control, SM501State),
1908         VMSTATE_UINT32(twoD_pitch, SM501State),
1909         VMSTATE_UINT32(twoD_foreground, SM501State),
1910         VMSTATE_UINT32(twoD_background, SM501State),
1911         VMSTATE_UINT32(twoD_stretch, SM501State),
1912         VMSTATE_UINT32(twoD_color_compare, SM501State),
1913         VMSTATE_UINT32(twoD_color_compare_mask, SM501State),
1914         VMSTATE_UINT32(twoD_mask, SM501State),
1915         VMSTATE_UINT32(twoD_clip_tl, SM501State),
1916         VMSTATE_UINT32(twoD_clip_br, SM501State),
1917         VMSTATE_UINT32(twoD_mono_pattern_low, SM501State),
1918         VMSTATE_UINT32(twoD_mono_pattern_high, SM501State),
1919         VMSTATE_UINT32(twoD_window_width, SM501State),
1920         VMSTATE_UINT32(twoD_source_base, SM501State),
1921         VMSTATE_UINT32(twoD_destination_base, SM501State),
1922         VMSTATE_UINT32(twoD_alpha, SM501State),
1923         VMSTATE_UINT32(twoD_wrap, SM501State),
1924         /* Added in version 2 */
1925         VMSTATE_UINT8(i2c_byte_count, SM501State),
1926         VMSTATE_UINT8(i2c_status, SM501State),
1927         VMSTATE_UINT8(i2c_addr, SM501State),
1928         VMSTATE_UINT8_ARRAY(i2c_data, SM501State, 16),
1929         VMSTATE_END_OF_LIST()
1930      }
1931 };
1932 
1933 #define TYPE_SYSBUS_SM501 "sysbus-sm501"
1934 #define SYSBUS_SM501(obj) \
1935     OBJECT_CHECK(SM501SysBusState, (obj), TYPE_SYSBUS_SM501)
1936 
1937 typedef struct {
1938     /*< private >*/
1939     SysBusDevice parent_obj;
1940     /*< public >*/
1941     SM501State state;
1942     uint32_t vram_size;
1943     uint32_t base;
1944     SerialMM serial;
1945 } SM501SysBusState;
1946 
1947 static void sm501_realize_sysbus(DeviceState *dev, Error **errp)
1948 {
1949     SM501SysBusState *s = SYSBUS_SM501(dev);
1950     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1951     DeviceState *usb_dev;
1952     MemoryRegion *mr;
1953 
1954     sm501_init(&s->state, dev, s->vram_size);
1955     if (get_local_mem_size(&s->state) != s->vram_size) {
1956         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
1957                    get_local_mem_size(&s->state));
1958         return;
1959     }
1960     sysbus_init_mmio(sbd, &s->state.local_mem_region);
1961     sysbus_init_mmio(sbd, &s->state.mmio_region);
1962 
1963     /* bridge to usb host emulation module */
1964     usb_dev = qdev_new("sysbus-ohci");
1965     qdev_prop_set_uint32(usb_dev, "num-ports", 2);
1966     qdev_prop_set_uint64(usb_dev, "dma-offset", s->base);
1967     sysbus_realize_and_unref(SYS_BUS_DEVICE(usb_dev), &error_fatal);
1968     memory_region_add_subregion(&s->state.mmio_region, SM501_USB_HOST,
1969                        sysbus_mmio_get_region(SYS_BUS_DEVICE(usb_dev), 0));
1970     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(usb_dev));
1971 
1972     /* bridge to serial emulation module */
1973     sysbus_realize(SYS_BUS_DEVICE(&s->serial), &error_fatal);
1974     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->serial), 0);
1975     memory_region_add_subregion(&s->state.mmio_region, SM501_UART0, mr);
1976     /* TODO : chain irq to IRL */
1977 }
1978 
1979 static Property sm501_sysbus_properties[] = {
1980     DEFINE_PROP_UINT32("vram-size", SM501SysBusState, vram_size, 0),
1981     DEFINE_PROP_UINT32("base", SM501SysBusState, base, 0),
1982     DEFINE_PROP_END_OF_LIST(),
1983 };
1984 
1985 static void sm501_reset_sysbus(DeviceState *dev)
1986 {
1987     SM501SysBusState *s = SYSBUS_SM501(dev);
1988     sm501_reset(&s->state);
1989 }
1990 
1991 static const VMStateDescription vmstate_sm501_sysbus = {
1992     .name = TYPE_SYSBUS_SM501,
1993     .version_id = 2,
1994     .minimum_version_id = 2,
1995     .fields = (VMStateField[]) {
1996         VMSTATE_STRUCT(state, SM501SysBusState, 1,
1997                        vmstate_sm501_state, SM501State),
1998         VMSTATE_END_OF_LIST()
1999      }
2000 };
2001 
2002 static void sm501_sysbus_class_init(ObjectClass *klass, void *data)
2003 {
2004     DeviceClass *dc = DEVICE_CLASS(klass);
2005 
2006     dc->realize = sm501_realize_sysbus;
2007     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2008     dc->desc = "SM501 Multimedia Companion";
2009     device_class_set_props(dc, sm501_sysbus_properties);
2010     dc->reset = sm501_reset_sysbus;
2011     dc->vmsd = &vmstate_sm501_sysbus;
2012 }
2013 
2014 static void sm501_sysbus_init(Object *o)
2015 {
2016     SM501SysBusState *sm501 = SYSBUS_SM501(o);
2017     SerialMM *smm = &sm501->serial;
2018 
2019     object_initialize_child(o, "serial", smm, TYPE_SERIAL_MM);
2020     qdev_set_legacy_instance_id(DEVICE(smm), SM501_UART0, 2);
2021     qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
2022     qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
2023 
2024     object_property_add_alias(o, "chardev",
2025                               OBJECT(smm), "chardev");
2026 }
2027 
2028 static const TypeInfo sm501_sysbus_info = {
2029     .name          = TYPE_SYSBUS_SM501,
2030     .parent        = TYPE_SYS_BUS_DEVICE,
2031     .instance_size = sizeof(SM501SysBusState),
2032     .class_init    = sm501_sysbus_class_init,
2033     .instance_init = sm501_sysbus_init,
2034 };
2035 
2036 #define TYPE_PCI_SM501 "sm501"
2037 #define PCI_SM501(obj) OBJECT_CHECK(SM501PCIState, (obj), TYPE_PCI_SM501)
2038 
2039 typedef struct {
2040     /*< private >*/
2041     PCIDevice parent_obj;
2042     /*< public >*/
2043     SM501State state;
2044     uint32_t vram_size;
2045 } SM501PCIState;
2046 
2047 static void sm501_realize_pci(PCIDevice *dev, Error **errp)
2048 {
2049     SM501PCIState *s = PCI_SM501(dev);
2050 
2051     sm501_init(&s->state, DEVICE(dev), s->vram_size);
2052     if (get_local_mem_size(&s->state) != s->vram_size) {
2053         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
2054                    get_local_mem_size(&s->state));
2055         return;
2056     }
2057     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
2058                      &s->state.local_mem_region);
2059     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY,
2060                      &s->state.mmio_region);
2061 }
2062 
2063 static Property sm501_pci_properties[] = {
2064     DEFINE_PROP_UINT32("vram-size", SM501PCIState, vram_size, 64 * MiB),
2065     DEFINE_PROP_END_OF_LIST(),
2066 };
2067 
2068 static void sm501_reset_pci(DeviceState *dev)
2069 {
2070     SM501PCIState *s = PCI_SM501(dev);
2071     sm501_reset(&s->state);
2072     /* Bits 2:0 of misc_control register is 001 for PCI */
2073     s->state.misc_control |= 1;
2074 }
2075 
2076 static const VMStateDescription vmstate_sm501_pci = {
2077     .name = TYPE_PCI_SM501,
2078     .version_id = 2,
2079     .minimum_version_id = 2,
2080     .fields = (VMStateField[]) {
2081         VMSTATE_PCI_DEVICE(parent_obj, SM501PCIState),
2082         VMSTATE_STRUCT(state, SM501PCIState, 1,
2083                        vmstate_sm501_state, SM501State),
2084         VMSTATE_END_OF_LIST()
2085      }
2086 };
2087 
2088 static void sm501_pci_class_init(ObjectClass *klass, void *data)
2089 {
2090     DeviceClass *dc = DEVICE_CLASS(klass);
2091     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2092 
2093     k->realize = sm501_realize_pci;
2094     k->vendor_id = PCI_VENDOR_ID_SILICON_MOTION;
2095     k->device_id = PCI_DEVICE_ID_SM501;
2096     k->class_id = PCI_CLASS_DISPLAY_OTHER;
2097     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2098     dc->desc = "SM501 Display Controller";
2099     device_class_set_props(dc, sm501_pci_properties);
2100     dc->reset = sm501_reset_pci;
2101     dc->hotpluggable = false;
2102     dc->vmsd = &vmstate_sm501_pci;
2103 }
2104 
2105 static const TypeInfo sm501_pci_info = {
2106     .name          = TYPE_PCI_SM501,
2107     .parent        = TYPE_PCI_DEVICE,
2108     .instance_size = sizeof(SM501PCIState),
2109     .class_init    = sm501_pci_class_init,
2110     .interfaces = (InterfaceInfo[]) {
2111         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2112         { },
2113     },
2114 };
2115 
2116 static void sm501_register_types(void)
2117 {
2118     type_register_static(&sm501_sysbus_info);
2119     type_register_static(&sm501_pci_info);
2120 }
2121 
2122 type_init(sm501_register_types)
2123