xref: /qemu/hw/display/cirrus_vga.c (revision 20daa90a)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "qemu/osdep.h"
30 #include "qapi/error.h"
31 #include "hw/hw.h"
32 #include "hw/pci/pci.h"
33 #include "ui/console.h"
34 #include "ui/pixel_ops.h"
35 #include "vga_int.h"
36 #include "hw/loader.h"
37 
38 /*
39  * TODO:
40  *    - destination write mask support not complete (bits 5..7)
41  *    - optimize linear mappings
42  *    - optimize bitblt functions
43  */
44 
45 //#define DEBUG_CIRRUS
46 //#define DEBUG_BITBLT
47 
48 /***************************************
49  *
50  *  definitions
51  *
52  ***************************************/
53 
54 // ID
55 #define CIRRUS_ID_CLGD5422  (0x23<<2)
56 #define CIRRUS_ID_CLGD5426  (0x24<<2)
57 #define CIRRUS_ID_CLGD5424  (0x25<<2)
58 #define CIRRUS_ID_CLGD5428  (0x26<<2)
59 #define CIRRUS_ID_CLGD5430  (0x28<<2)
60 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
61 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
62 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
63 
64 // sequencer 0x07
65 #define CIRRUS_SR7_BPP_VGA            0x00
66 #define CIRRUS_SR7_BPP_SVGA           0x01
67 #define CIRRUS_SR7_BPP_MASK           0x0e
68 #define CIRRUS_SR7_BPP_8              0x00
69 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
70 #define CIRRUS_SR7_BPP_24             0x04
71 #define CIRRUS_SR7_BPP_16             0x06
72 #define CIRRUS_SR7_BPP_32             0x08
73 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
74 
75 // sequencer 0x0f
76 #define CIRRUS_MEMSIZE_512k        0x08
77 #define CIRRUS_MEMSIZE_1M          0x10
78 #define CIRRUS_MEMSIZE_2M          0x18
79 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
80 
81 // sequencer 0x12
82 #define CIRRUS_CURSOR_SHOW         0x01
83 #define CIRRUS_CURSOR_HIDDENPEL    0x02
84 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
85 
86 // sequencer 0x17
87 #define CIRRUS_BUSTYPE_VLBFAST   0x10
88 #define CIRRUS_BUSTYPE_PCI       0x20
89 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
90 #define CIRRUS_BUSTYPE_ISA       0x38
91 #define CIRRUS_MMIO_ENABLE       0x04
92 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
93 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
94 
95 // control 0x0b
96 #define CIRRUS_BANKING_DUAL             0x01
97 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
98 
99 // control 0x30
100 #define CIRRUS_BLTMODE_BACKWARDS        0x01
101 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
102 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
103 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
104 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
105 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
106 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
107 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
108 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
109 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
110 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
111 
112 // control 0x31
113 #define CIRRUS_BLT_BUSY                 0x01
114 #define CIRRUS_BLT_START                0x02
115 #define CIRRUS_BLT_RESET                0x04
116 #define CIRRUS_BLT_FIFOUSED             0x10
117 #define CIRRUS_BLT_AUTOSTART            0x80
118 
119 // control 0x32
120 #define CIRRUS_ROP_0                    0x00
121 #define CIRRUS_ROP_SRC_AND_DST          0x05
122 #define CIRRUS_ROP_NOP                  0x06
123 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
124 #define CIRRUS_ROP_NOTDST               0x0b
125 #define CIRRUS_ROP_SRC                  0x0d
126 #define CIRRUS_ROP_1                    0x0e
127 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
128 #define CIRRUS_ROP_SRC_XOR_DST          0x59
129 #define CIRRUS_ROP_SRC_OR_DST           0x6d
130 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
131 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
132 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
133 #define CIRRUS_ROP_NOTSRC               0xd0
134 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
135 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
136 
137 #define CIRRUS_ROP_NOP_INDEX 2
138 #define CIRRUS_ROP_SRC_INDEX 5
139 
140 // control 0x33
141 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
142 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
143 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
144 
145 // memory-mapped IO
146 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
147 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
148 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
149 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
150 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
151 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
152 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
153 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
154 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
155 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
156 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
157 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
158 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
159 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
160 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
161 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
162 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
163 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
166 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
167 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
168 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
169 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
170 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
171 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
172 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
173 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
174 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
175 
176 #define CIRRUS_PNPMMIO_SIZE         0x1000
177 
178 struct CirrusVGAState;
179 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
180                                      uint8_t * dst, const uint8_t * src,
181 				     int dstpitch, int srcpitch,
182 				     int bltwidth, int bltheight);
183 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
184                               uint8_t *dst, int dst_pitch, int width, int height);
185 
186 typedef struct CirrusVGAState {
187     VGACommonState vga;
188 
189     MemoryRegion cirrus_vga_io;
190     MemoryRegion cirrus_linear_io;
191     MemoryRegion cirrus_linear_bitblt_io;
192     MemoryRegion cirrus_mmio_io;
193     MemoryRegion pci_bar;
194     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
195     MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
196     MemoryRegion low_mem;           /* always mapped, overridden by: */
197     MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
198     uint32_t cirrus_addr_mask;
199     uint32_t linear_mmio_mask;
200     uint8_t cirrus_shadow_gr0;
201     uint8_t cirrus_shadow_gr1;
202     uint8_t cirrus_hidden_dac_lockindex;
203     uint8_t cirrus_hidden_dac_data;
204     uint32_t cirrus_bank_base[2];
205     uint32_t cirrus_bank_limit[2];
206     uint8_t cirrus_hidden_palette[48];
207     int cirrus_blt_pixelwidth;
208     int cirrus_blt_width;
209     int cirrus_blt_height;
210     int cirrus_blt_dstpitch;
211     int cirrus_blt_srcpitch;
212     uint32_t cirrus_blt_fgcol;
213     uint32_t cirrus_blt_bgcol;
214     uint32_t cirrus_blt_dstaddr;
215     uint32_t cirrus_blt_srcaddr;
216     uint8_t cirrus_blt_mode;
217     uint8_t cirrus_blt_modeext;
218     cirrus_bitblt_rop_t cirrus_rop;
219 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
220     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
221     uint8_t *cirrus_srcptr;
222     uint8_t *cirrus_srcptr_end;
223     uint32_t cirrus_srccounter;
224     /* hwcursor display state */
225     int last_hw_cursor_size;
226     int last_hw_cursor_x;
227     int last_hw_cursor_y;
228     int last_hw_cursor_y_start;
229     int last_hw_cursor_y_end;
230     int real_vram_size; /* XXX: suppress that */
231     int device_id;
232     int bustype;
233 } CirrusVGAState;
234 
235 typedef struct PCICirrusVGAState {
236     PCIDevice dev;
237     CirrusVGAState cirrus_vga;
238 } PCICirrusVGAState;
239 
240 #define TYPE_PCI_CIRRUS_VGA "cirrus-vga"
241 #define PCI_CIRRUS_VGA(obj) \
242     OBJECT_CHECK(PCICirrusVGAState, (obj), TYPE_PCI_CIRRUS_VGA)
243 
244 #define TYPE_ISA_CIRRUS_VGA "isa-cirrus-vga"
245 #define ISA_CIRRUS_VGA(obj) \
246     OBJECT_CHECK(ISACirrusVGAState, (obj), TYPE_ISA_CIRRUS_VGA)
247 
248 typedef struct ISACirrusVGAState {
249     ISADevice parent_obj;
250 
251     CirrusVGAState cirrus_vga;
252 } ISACirrusVGAState;
253 
254 static uint8_t rop_to_index[256];
255 
256 /***************************************
257  *
258  *  prototypes.
259  *
260  ***************************************/
261 
262 
263 static void cirrus_bitblt_reset(CirrusVGAState *s);
264 static void cirrus_update_memory_access(CirrusVGAState *s);
265 
266 /***************************************
267  *
268  *  raster operations
269  *
270  ***************************************/
271 
272 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
273                                   int32_t pitch, int32_t addr)
274 {
275     if (!pitch) {
276         return true;
277     }
278     if (pitch < 0) {
279         int64_t min = addr
280             + ((int64_t)s->cirrus_blt_height-1) * pitch;
281         int32_t max = addr
282             + s->cirrus_blt_width;
283         if (min < 0 || max > s->vga.vram_size) {
284             return true;
285         }
286     } else {
287         int64_t max = addr
288             + ((int64_t)s->cirrus_blt_height-1) * pitch
289             + s->cirrus_blt_width;
290         if (max > s->vga.vram_size) {
291             return true;
292         }
293     }
294     return false;
295 }
296 
297 static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)
298 {
299     /* should be the case, see cirrus_bitblt_start */
300     assert(s->cirrus_blt_width > 0);
301     assert(s->cirrus_blt_height > 0);
302 
303     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
304         return true;
305     }
306 
307     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
308                               s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
309         return true;
310     }
311     if (dst_only) {
312         return false;
313     }
314     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
315                               s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
316         return true;
317     }
318 
319     return false;
320 }
321 
322 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
323                                   uint8_t *dst,const uint8_t *src,
324                                   int dstpitch,int srcpitch,
325                                   int bltwidth,int bltheight)
326 {
327 }
328 
329 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
330                                    uint8_t *dst,
331                                    int dstpitch, int bltwidth,int bltheight)
332 {
333 }
334 
335 #define ROP_NAME 0
336 #define ROP_FN(d, s) 0
337 #include "cirrus_vga_rop.h"
338 
339 #define ROP_NAME src_and_dst
340 #define ROP_FN(d, s) (s) & (d)
341 #include "cirrus_vga_rop.h"
342 
343 #define ROP_NAME src_and_notdst
344 #define ROP_FN(d, s) (s) & (~(d))
345 #include "cirrus_vga_rop.h"
346 
347 #define ROP_NAME notdst
348 #define ROP_FN(d, s) ~(d)
349 #include "cirrus_vga_rop.h"
350 
351 #define ROP_NAME src
352 #define ROP_FN(d, s) s
353 #include "cirrus_vga_rop.h"
354 
355 #define ROP_NAME 1
356 #define ROP_FN(d, s) ~0
357 #include "cirrus_vga_rop.h"
358 
359 #define ROP_NAME notsrc_and_dst
360 #define ROP_FN(d, s) (~(s)) & (d)
361 #include "cirrus_vga_rop.h"
362 
363 #define ROP_NAME src_xor_dst
364 #define ROP_FN(d, s) (s) ^ (d)
365 #include "cirrus_vga_rop.h"
366 
367 #define ROP_NAME src_or_dst
368 #define ROP_FN(d, s) (s) | (d)
369 #include "cirrus_vga_rop.h"
370 
371 #define ROP_NAME notsrc_or_notdst
372 #define ROP_FN(d, s) (~(s)) | (~(d))
373 #include "cirrus_vga_rop.h"
374 
375 #define ROP_NAME src_notxor_dst
376 #define ROP_FN(d, s) ~((s) ^ (d))
377 #include "cirrus_vga_rop.h"
378 
379 #define ROP_NAME src_or_notdst
380 #define ROP_FN(d, s) (s) | (~(d))
381 #include "cirrus_vga_rop.h"
382 
383 #define ROP_NAME notsrc
384 #define ROP_FN(d, s) (~(s))
385 #include "cirrus_vga_rop.h"
386 
387 #define ROP_NAME notsrc_or_dst
388 #define ROP_FN(d, s) (~(s)) | (d)
389 #include "cirrus_vga_rop.h"
390 
391 #define ROP_NAME notsrc_and_notdst
392 #define ROP_FN(d, s) (~(s)) & (~(d))
393 #include "cirrus_vga_rop.h"
394 
395 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
396     cirrus_bitblt_rop_fwd_0,
397     cirrus_bitblt_rop_fwd_src_and_dst,
398     cirrus_bitblt_rop_nop,
399     cirrus_bitblt_rop_fwd_src_and_notdst,
400     cirrus_bitblt_rop_fwd_notdst,
401     cirrus_bitblt_rop_fwd_src,
402     cirrus_bitblt_rop_fwd_1,
403     cirrus_bitblt_rop_fwd_notsrc_and_dst,
404     cirrus_bitblt_rop_fwd_src_xor_dst,
405     cirrus_bitblt_rop_fwd_src_or_dst,
406     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
407     cirrus_bitblt_rop_fwd_src_notxor_dst,
408     cirrus_bitblt_rop_fwd_src_or_notdst,
409     cirrus_bitblt_rop_fwd_notsrc,
410     cirrus_bitblt_rop_fwd_notsrc_or_dst,
411     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
412 };
413 
414 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
415     cirrus_bitblt_rop_bkwd_0,
416     cirrus_bitblt_rop_bkwd_src_and_dst,
417     cirrus_bitblt_rop_nop,
418     cirrus_bitblt_rop_bkwd_src_and_notdst,
419     cirrus_bitblt_rop_bkwd_notdst,
420     cirrus_bitblt_rop_bkwd_src,
421     cirrus_bitblt_rop_bkwd_1,
422     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
423     cirrus_bitblt_rop_bkwd_src_xor_dst,
424     cirrus_bitblt_rop_bkwd_src_or_dst,
425     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
426     cirrus_bitblt_rop_bkwd_src_notxor_dst,
427     cirrus_bitblt_rop_bkwd_src_or_notdst,
428     cirrus_bitblt_rop_bkwd_notsrc,
429     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
430     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
431 };
432 
433 #define TRANSP_ROP(name) {\
434     name ## _8,\
435     name ## _16,\
436         }
437 #define TRANSP_NOP(func) {\
438     func,\
439     func,\
440         }
441 
442 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
443     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
444     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
445     TRANSP_NOP(cirrus_bitblt_rop_nop),
446     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
447     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
448     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
449     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
450     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
451     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
452     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
453     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
454     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
455     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
456     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
457     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
458     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
459 };
460 
461 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
462     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
463     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
464     TRANSP_NOP(cirrus_bitblt_rop_nop),
465     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
466     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
467     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
468     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
469     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
470     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
471     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
472     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
473     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
474     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
475     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
476     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
477     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
478 };
479 
480 #define ROP2(name) {\
481     name ## _8,\
482     name ## _16,\
483     name ## _24,\
484     name ## _32,\
485         }
486 
487 #define ROP_NOP2(func) {\
488     func,\
489     func,\
490     func,\
491     func,\
492         }
493 
494 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
495     ROP2(cirrus_patternfill_0),
496     ROP2(cirrus_patternfill_src_and_dst),
497     ROP_NOP2(cirrus_bitblt_rop_nop),
498     ROP2(cirrus_patternfill_src_and_notdst),
499     ROP2(cirrus_patternfill_notdst),
500     ROP2(cirrus_patternfill_src),
501     ROP2(cirrus_patternfill_1),
502     ROP2(cirrus_patternfill_notsrc_and_dst),
503     ROP2(cirrus_patternfill_src_xor_dst),
504     ROP2(cirrus_patternfill_src_or_dst),
505     ROP2(cirrus_patternfill_notsrc_or_notdst),
506     ROP2(cirrus_patternfill_src_notxor_dst),
507     ROP2(cirrus_patternfill_src_or_notdst),
508     ROP2(cirrus_patternfill_notsrc),
509     ROP2(cirrus_patternfill_notsrc_or_dst),
510     ROP2(cirrus_patternfill_notsrc_and_notdst),
511 };
512 
513 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
514     ROP2(cirrus_colorexpand_transp_0),
515     ROP2(cirrus_colorexpand_transp_src_and_dst),
516     ROP_NOP2(cirrus_bitblt_rop_nop),
517     ROP2(cirrus_colorexpand_transp_src_and_notdst),
518     ROP2(cirrus_colorexpand_transp_notdst),
519     ROP2(cirrus_colorexpand_transp_src),
520     ROP2(cirrus_colorexpand_transp_1),
521     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
522     ROP2(cirrus_colorexpand_transp_src_xor_dst),
523     ROP2(cirrus_colorexpand_transp_src_or_dst),
524     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
525     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
526     ROP2(cirrus_colorexpand_transp_src_or_notdst),
527     ROP2(cirrus_colorexpand_transp_notsrc),
528     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
529     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
530 };
531 
532 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
533     ROP2(cirrus_colorexpand_0),
534     ROP2(cirrus_colorexpand_src_and_dst),
535     ROP_NOP2(cirrus_bitblt_rop_nop),
536     ROP2(cirrus_colorexpand_src_and_notdst),
537     ROP2(cirrus_colorexpand_notdst),
538     ROP2(cirrus_colorexpand_src),
539     ROP2(cirrus_colorexpand_1),
540     ROP2(cirrus_colorexpand_notsrc_and_dst),
541     ROP2(cirrus_colorexpand_src_xor_dst),
542     ROP2(cirrus_colorexpand_src_or_dst),
543     ROP2(cirrus_colorexpand_notsrc_or_notdst),
544     ROP2(cirrus_colorexpand_src_notxor_dst),
545     ROP2(cirrus_colorexpand_src_or_notdst),
546     ROP2(cirrus_colorexpand_notsrc),
547     ROP2(cirrus_colorexpand_notsrc_or_dst),
548     ROP2(cirrus_colorexpand_notsrc_and_notdst),
549 };
550 
551 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
552     ROP2(cirrus_colorexpand_pattern_transp_0),
553     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
554     ROP_NOP2(cirrus_bitblt_rop_nop),
555     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
556     ROP2(cirrus_colorexpand_pattern_transp_notdst),
557     ROP2(cirrus_colorexpand_pattern_transp_src),
558     ROP2(cirrus_colorexpand_pattern_transp_1),
559     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
560     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
561     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
562     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
563     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
564     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
565     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
566     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
567     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
568 };
569 
570 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
571     ROP2(cirrus_colorexpand_pattern_0),
572     ROP2(cirrus_colorexpand_pattern_src_and_dst),
573     ROP_NOP2(cirrus_bitblt_rop_nop),
574     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
575     ROP2(cirrus_colorexpand_pattern_notdst),
576     ROP2(cirrus_colorexpand_pattern_src),
577     ROP2(cirrus_colorexpand_pattern_1),
578     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
579     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
580     ROP2(cirrus_colorexpand_pattern_src_or_dst),
581     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
582     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
583     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
584     ROP2(cirrus_colorexpand_pattern_notsrc),
585     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
586     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
587 };
588 
589 static const cirrus_fill_t cirrus_fill[16][4] = {
590     ROP2(cirrus_fill_0),
591     ROP2(cirrus_fill_src_and_dst),
592     ROP_NOP2(cirrus_bitblt_fill_nop),
593     ROP2(cirrus_fill_src_and_notdst),
594     ROP2(cirrus_fill_notdst),
595     ROP2(cirrus_fill_src),
596     ROP2(cirrus_fill_1),
597     ROP2(cirrus_fill_notsrc_and_dst),
598     ROP2(cirrus_fill_src_xor_dst),
599     ROP2(cirrus_fill_src_or_dst),
600     ROP2(cirrus_fill_notsrc_or_notdst),
601     ROP2(cirrus_fill_src_notxor_dst),
602     ROP2(cirrus_fill_src_or_notdst),
603     ROP2(cirrus_fill_notsrc),
604     ROP2(cirrus_fill_notsrc_or_dst),
605     ROP2(cirrus_fill_notsrc_and_notdst),
606 };
607 
608 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
609 {
610     unsigned int color;
611     switch (s->cirrus_blt_pixelwidth) {
612     case 1:
613         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
614         break;
615     case 2:
616         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
617         s->cirrus_blt_fgcol = le16_to_cpu(color);
618         break;
619     case 3:
620         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
621             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
622         break;
623     default:
624     case 4:
625         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
626             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
627         s->cirrus_blt_fgcol = le32_to_cpu(color);
628         break;
629     }
630 }
631 
632 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
633 {
634     unsigned int color;
635     switch (s->cirrus_blt_pixelwidth) {
636     case 1:
637         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
638         break;
639     case 2:
640         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
641         s->cirrus_blt_bgcol = le16_to_cpu(color);
642         break;
643     case 3:
644         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
645             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
646         break;
647     default:
648     case 4:
649         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
650             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
651         s->cirrus_blt_bgcol = le32_to_cpu(color);
652         break;
653     }
654 }
655 
656 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
657 				     int off_pitch, int bytesperline,
658 				     int lines)
659 {
660     int y;
661     int off_cur;
662     int off_cur_end;
663 
664     for (y = 0; y < lines; y++) {
665 	off_cur = off_begin;
666 	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
667         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
668 	off_begin += off_pitch;
669     }
670 }
671 
672 static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
673 					    const uint8_t * src)
674 {
675     uint8_t *dst;
676 
677     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
678 
679     if (blit_is_unsafe(s, false))
680         return 0;
681 
682     (*s->cirrus_rop) (s, dst, src,
683                       s->cirrus_blt_dstpitch, 0,
684                       s->cirrus_blt_width, s->cirrus_blt_height);
685     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
686                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
687                              s->cirrus_blt_height);
688     return 1;
689 }
690 
691 /* fill */
692 
693 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
694 {
695     cirrus_fill_t rop_func;
696 
697     if (blit_is_unsafe(s, true)) {
698         return 0;
699     }
700     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
701     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
702              s->cirrus_blt_dstpitch,
703              s->cirrus_blt_width, s->cirrus_blt_height);
704     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
705 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
706 			     s->cirrus_blt_height);
707     cirrus_bitblt_reset(s);
708     return 1;
709 }
710 
711 /***************************************
712  *
713  *  bitblt (video-to-video)
714  *
715  ***************************************/
716 
717 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
718 {
719     return cirrus_bitblt_common_patterncopy(s,
720 					    s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
721                                             s->cirrus_addr_mask));
722 }
723 
724 static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
725 {
726     int sx = 0, sy = 0;
727     int dx = 0, dy = 0;
728     int depth = 0;
729     int notify = 0;
730 
731     /* make sure to only copy if it's a plain copy ROP */
732     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
733         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
734 
735         int width, height;
736 
737         depth = s->vga.get_bpp(&s->vga) / 8;
738         if (!depth) {
739             return 0;
740         }
741         s->vga.get_resolution(&s->vga, &width, &height);
742 
743         /* extra x, y */
744         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
745         sy = (src / ABS(s->cirrus_blt_srcpitch));
746         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
747         dy = (dst / ABS(s->cirrus_blt_dstpitch));
748 
749         /* normalize width */
750         w /= depth;
751 
752         /* if we're doing a backward copy, we have to adjust
753            our x/y to be the upper left corner (instead of the lower
754            right corner) */
755         if (s->cirrus_blt_dstpitch < 0) {
756             sx -= (s->cirrus_blt_width / depth) - 1;
757             dx -= (s->cirrus_blt_width / depth) - 1;
758             sy -= s->cirrus_blt_height - 1;
759             dy -= s->cirrus_blt_height - 1;
760         }
761 
762         /* are we in the visible portion of memory? */
763         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
764             (sx + w) <= width && (sy + h) <= height &&
765             (dx + w) <= width && (dy + h) <= height) {
766             notify = 1;
767         }
768     }
769 
770     /* we have to flush all pending changes so that the copy
771        is generated at the appropriate moment in time */
772     if (notify)
773         graphic_hw_update(s->vga.con);
774 
775     (*s->cirrus_rop) (s, s->vga.vram_ptr +
776 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
777 		      s->vga.vram_ptr +
778 		      (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
779 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
780 		      s->cirrus_blt_width, s->cirrus_blt_height);
781 
782     if (notify) {
783         qemu_console_copy(s->vga.con,
784 			  sx, sy, dx, dy,
785 			  s->cirrus_blt_width / depth,
786 			  s->cirrus_blt_height);
787     }
788 
789     /* we don't have to notify the display that this portion has
790        changed since qemu_console_copy implies this */
791 
792     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
793 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
794 				s->cirrus_blt_height);
795 
796     return 1;
797 }
798 
799 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
800 {
801     if (blit_is_unsafe(s, false))
802         return 0;
803 
804     return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
805             s->cirrus_blt_srcaddr - s->vga.start_addr,
806             s->cirrus_blt_width, s->cirrus_blt_height);
807 }
808 
809 /***************************************
810  *
811  *  bitblt (cpu-to-video)
812  *
813  ***************************************/
814 
815 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
816 {
817     int copy_count;
818     uint8_t *end_ptr;
819 
820     if (s->cirrus_srccounter > 0) {
821         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
822             cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);
823         the_end:
824             s->cirrus_srccounter = 0;
825             cirrus_bitblt_reset(s);
826         } else {
827             /* at least one scan line */
828             do {
829                 (*s->cirrus_rop)(s, s->vga.vram_ptr +
830                                  (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
831                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
832                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
833                                          s->cirrus_blt_width, 1);
834                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
835                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
836                 if (s->cirrus_srccounter <= 0)
837                     goto the_end;
838                 /* more bytes than needed can be transferred because of
839                    word alignment, so we keep them for the next line */
840                 /* XXX: keep alignment to speed up transfer */
841                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
842                 copy_count = s->cirrus_srcptr_end - end_ptr;
843                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
844                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
845                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
846             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
847         }
848     }
849 }
850 
851 /***************************************
852  *
853  *  bitblt wrapper
854  *
855  ***************************************/
856 
857 static void cirrus_bitblt_reset(CirrusVGAState * s)
858 {
859     int need_update;
860 
861     s->vga.gr[0x31] &=
862 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
863     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
864         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
865     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
866     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
867     s->cirrus_srccounter = 0;
868     if (!need_update)
869         return;
870     cirrus_update_memory_access(s);
871 }
872 
873 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
874 {
875     int w;
876 
877     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
878     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
879     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
880 
881     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
882 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
883 	    s->cirrus_blt_srcpitch = 8;
884 	} else {
885             /* XXX: check for 24 bpp */
886 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
887 	}
888 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
889     } else {
890 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
891             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
892             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
893                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
894             else
895                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
896 	} else {
897             /* always align input size to 32 bits */
898 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
899 	}
900         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
901     }
902     s->cirrus_srcptr = s->cirrus_bltbuf;
903     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
904     cirrus_update_memory_access(s);
905     return 1;
906 }
907 
908 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
909 {
910     /* XXX */
911 #ifdef DEBUG_BITBLT
912     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
913 #endif
914     return 0;
915 }
916 
917 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
918 {
919     int ret;
920 
921     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
922 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
923     } else {
924 	ret = cirrus_bitblt_videotovideo_copy(s);
925     }
926     if (ret)
927 	cirrus_bitblt_reset(s);
928     return ret;
929 }
930 
931 static void cirrus_bitblt_start(CirrusVGAState * s)
932 {
933     uint8_t blt_rop;
934 
935     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
936 
937     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
938     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
939     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
940     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
941     s->cirrus_blt_dstaddr =
942 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
943     s->cirrus_blt_srcaddr =
944 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
945     s->cirrus_blt_mode = s->vga.gr[0x30];
946     s->cirrus_blt_modeext = s->vga.gr[0x33];
947     blt_rop = s->vga.gr[0x32];
948 
949 #ifdef DEBUG_BITBLT
950     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
951            blt_rop,
952            s->cirrus_blt_mode,
953            s->cirrus_blt_modeext,
954            s->cirrus_blt_width,
955            s->cirrus_blt_height,
956            s->cirrus_blt_dstpitch,
957            s->cirrus_blt_srcpitch,
958            s->cirrus_blt_dstaddr,
959            s->cirrus_blt_srcaddr,
960            s->vga.gr[0x2f]);
961 #endif
962 
963     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
964     case CIRRUS_BLTMODE_PIXELWIDTH8:
965 	s->cirrus_blt_pixelwidth = 1;
966 	break;
967     case CIRRUS_BLTMODE_PIXELWIDTH16:
968 	s->cirrus_blt_pixelwidth = 2;
969 	break;
970     case CIRRUS_BLTMODE_PIXELWIDTH24:
971 	s->cirrus_blt_pixelwidth = 3;
972 	break;
973     case CIRRUS_BLTMODE_PIXELWIDTH32:
974 	s->cirrus_blt_pixelwidth = 4;
975 	break;
976     default:
977 #ifdef DEBUG_BITBLT
978 	printf("cirrus: bitblt - pixel width is unknown\n");
979 #endif
980 	goto bitblt_ignore;
981     }
982     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
983 
984     if ((s->
985 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
986 			    CIRRUS_BLTMODE_MEMSYSDEST))
987 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
988 #ifdef DEBUG_BITBLT
989 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
990 #endif
991 	goto bitblt_ignore;
992     }
993 
994     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
995         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
996                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
997                                CIRRUS_BLTMODE_PATTERNCOPY |
998                                CIRRUS_BLTMODE_COLOREXPAND)) ==
999          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
1000         cirrus_bitblt_fgcol(s);
1001         cirrus_bitblt_solidfill(s, blt_rop);
1002     } else {
1003         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
1004                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
1005             CIRRUS_BLTMODE_COLOREXPAND) {
1006 
1007             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1008                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1009                     cirrus_bitblt_bgcol(s);
1010                 else
1011                     cirrus_bitblt_fgcol(s);
1012                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1013             } else {
1014                 cirrus_bitblt_fgcol(s);
1015                 cirrus_bitblt_bgcol(s);
1016                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1017             }
1018         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1019             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1020                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1021                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1022                         cirrus_bitblt_bgcol(s);
1023                     else
1024                         cirrus_bitblt_fgcol(s);
1025                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1026                 } else {
1027                     cirrus_bitblt_fgcol(s);
1028                     cirrus_bitblt_bgcol(s);
1029                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1030                 }
1031             } else {
1032                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1033             }
1034         } else {
1035 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1036 		if (s->cirrus_blt_pixelwidth > 2) {
1037 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1038 		    goto bitblt_ignore;
1039 		}
1040 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1041 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1042 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1043 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1044 		} else {
1045 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1046 		}
1047 	    } else {
1048 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1049 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1050 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1051 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1052 		} else {
1053 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1054 		}
1055 	    }
1056 	}
1057         // setup bitblt engine.
1058         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1059             if (!cirrus_bitblt_cputovideo(s))
1060                 goto bitblt_ignore;
1061         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1062             if (!cirrus_bitblt_videotocpu(s))
1063                 goto bitblt_ignore;
1064         } else {
1065             if (!cirrus_bitblt_videotovideo(s))
1066                 goto bitblt_ignore;
1067         }
1068     }
1069     return;
1070   bitblt_ignore:;
1071     cirrus_bitblt_reset(s);
1072 }
1073 
1074 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1075 {
1076     unsigned old_value;
1077 
1078     old_value = s->vga.gr[0x31];
1079     s->vga.gr[0x31] = reg_value;
1080 
1081     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1082 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1083 	cirrus_bitblt_reset(s);
1084     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1085 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1086 	cirrus_bitblt_start(s);
1087     }
1088 }
1089 
1090 
1091 /***************************************
1092  *
1093  *  basic parameters
1094  *
1095  ***************************************/
1096 
1097 static void cirrus_get_offsets(VGACommonState *s1,
1098                                uint32_t *pline_offset,
1099                                uint32_t *pstart_addr,
1100                                uint32_t *pline_compare)
1101 {
1102     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1103     uint32_t start_addr, line_offset, line_compare;
1104 
1105     line_offset = s->vga.cr[0x13]
1106 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1107     line_offset <<= 3;
1108     *pline_offset = line_offset;
1109 
1110     start_addr = (s->vga.cr[0x0c] << 8)
1111 	| s->vga.cr[0x0d]
1112 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1113 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1114 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1115     *pstart_addr = start_addr;
1116 
1117     line_compare = s->vga.cr[0x18] |
1118         ((s->vga.cr[0x07] & 0x10) << 4) |
1119         ((s->vga.cr[0x09] & 0x40) << 3);
1120     *pline_compare = line_compare;
1121 }
1122 
1123 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1124 {
1125     uint32_t ret = 16;
1126 
1127     switch (s->cirrus_hidden_dac_data & 0xf) {
1128     case 0:
1129 	ret = 15;
1130 	break;			/* Sierra HiColor */
1131     case 1:
1132 	ret = 16;
1133 	break;			/* XGA HiColor */
1134     default:
1135 #ifdef DEBUG_CIRRUS
1136 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1137 	       (s->cirrus_hidden_dac_data & 0xf));
1138 #endif
1139 	ret = 15;		/* XXX */
1140 	break;
1141     }
1142     return ret;
1143 }
1144 
1145 static int cirrus_get_bpp(VGACommonState *s1)
1146 {
1147     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1148     uint32_t ret = 8;
1149 
1150     if ((s->vga.sr[0x07] & 0x01) != 0) {
1151 	/* Cirrus SVGA */
1152 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1153 	case CIRRUS_SR7_BPP_8:
1154 	    ret = 8;
1155 	    break;
1156 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1157 	    ret = cirrus_get_bpp16_depth(s);
1158 	    break;
1159 	case CIRRUS_SR7_BPP_24:
1160 	    ret = 24;
1161 	    break;
1162 	case CIRRUS_SR7_BPP_16:
1163 	    ret = cirrus_get_bpp16_depth(s);
1164 	    break;
1165 	case CIRRUS_SR7_BPP_32:
1166 	    ret = 32;
1167 	    break;
1168 	default:
1169 #ifdef DEBUG_CIRRUS
1170 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1171 #endif
1172 	    ret = 8;
1173 	    break;
1174 	}
1175     } else {
1176 	/* VGA */
1177 	ret = 0;
1178     }
1179 
1180     return ret;
1181 }
1182 
1183 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1184 {
1185     int width, height;
1186 
1187     width = (s->cr[0x01] + 1) * 8;
1188     height = s->cr[0x12] |
1189         ((s->cr[0x07] & 0x02) << 7) |
1190         ((s->cr[0x07] & 0x40) << 3);
1191     height = (height + 1);
1192     /* interlace support */
1193     if (s->cr[0x1a] & 0x01)
1194         height = height * 2;
1195     *pwidth = width;
1196     *pheight = height;
1197 }
1198 
1199 /***************************************
1200  *
1201  * bank memory
1202  *
1203  ***************************************/
1204 
1205 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1206 {
1207     unsigned offset;
1208     unsigned limit;
1209 
1210     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1211 	offset = s->vga.gr[0x09 + bank_index];
1212     else			/* single bank */
1213 	offset = s->vga.gr[0x09];
1214 
1215     if ((s->vga.gr[0x0b] & 0x20) != 0)
1216 	offset <<= 14;
1217     else
1218 	offset <<= 12;
1219 
1220     if (s->real_vram_size <= offset)
1221 	limit = 0;
1222     else
1223 	limit = s->real_vram_size - offset;
1224 
1225     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1226 	if (limit > 0x8000) {
1227 	    offset += 0x8000;
1228 	    limit -= 0x8000;
1229 	} else {
1230 	    limit = 0;
1231 	}
1232     }
1233 
1234     if (limit > 0) {
1235 	s->cirrus_bank_base[bank_index] = offset;
1236 	s->cirrus_bank_limit[bank_index] = limit;
1237     } else {
1238 	s->cirrus_bank_base[bank_index] = 0;
1239 	s->cirrus_bank_limit[bank_index] = 0;
1240     }
1241 }
1242 
1243 /***************************************
1244  *
1245  *  I/O access between 0x3c4-0x3c5
1246  *
1247  ***************************************/
1248 
1249 static int cirrus_vga_read_sr(CirrusVGAState * s)
1250 {
1251     switch (s->vga.sr_index) {
1252     case 0x00:			// Standard VGA
1253     case 0x01:			// Standard VGA
1254     case 0x02:			// Standard VGA
1255     case 0x03:			// Standard VGA
1256     case 0x04:			// Standard VGA
1257 	return s->vga.sr[s->vga.sr_index];
1258     case 0x06:			// Unlock Cirrus extensions
1259 	return s->vga.sr[s->vga.sr_index];
1260     case 0x10:
1261     case 0x30:
1262     case 0x50:
1263     case 0x70:			// Graphics Cursor X
1264     case 0x90:
1265     case 0xb0:
1266     case 0xd0:
1267     case 0xf0:			// Graphics Cursor X
1268 	return s->vga.sr[0x10];
1269     case 0x11:
1270     case 0x31:
1271     case 0x51:
1272     case 0x71:			// Graphics Cursor Y
1273     case 0x91:
1274     case 0xb1:
1275     case 0xd1:
1276     case 0xf1:			// Graphics Cursor Y
1277 	return s->vga.sr[0x11];
1278     case 0x05:			// ???
1279     case 0x07:			// Extended Sequencer Mode
1280     case 0x08:			// EEPROM Control
1281     case 0x09:			// Scratch Register 0
1282     case 0x0a:			// Scratch Register 1
1283     case 0x0b:			// VCLK 0
1284     case 0x0c:			// VCLK 1
1285     case 0x0d:			// VCLK 2
1286     case 0x0e:			// VCLK 3
1287     case 0x0f:			// DRAM Control
1288     case 0x12:			// Graphics Cursor Attribute
1289     case 0x13:			// Graphics Cursor Pattern Address
1290     case 0x14:			// Scratch Register 2
1291     case 0x15:			// Scratch Register 3
1292     case 0x16:			// Performance Tuning Register
1293     case 0x17:			// Configuration Readback and Extended Control
1294     case 0x18:			// Signature Generator Control
1295     case 0x19:			// Signal Generator Result
1296     case 0x1a:			// Signal Generator Result
1297     case 0x1b:			// VCLK 0 Denominator & Post
1298     case 0x1c:			// VCLK 1 Denominator & Post
1299     case 0x1d:			// VCLK 2 Denominator & Post
1300     case 0x1e:			// VCLK 3 Denominator & Post
1301     case 0x1f:			// BIOS Write Enable and MCLK select
1302 #ifdef DEBUG_CIRRUS
1303 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1304 #endif
1305 	return s->vga.sr[s->vga.sr_index];
1306     default:
1307 #ifdef DEBUG_CIRRUS
1308 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1309 #endif
1310 	return 0xff;
1311 	break;
1312     }
1313 }
1314 
1315 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1316 {
1317     switch (s->vga.sr_index) {
1318     case 0x00:			// Standard VGA
1319     case 0x01:			// Standard VGA
1320     case 0x02:			// Standard VGA
1321     case 0x03:			// Standard VGA
1322     case 0x04:			// Standard VGA
1323 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1324 	if (s->vga.sr_index == 1)
1325             s->vga.update_retrace_info(&s->vga);
1326         break;
1327     case 0x06:			// Unlock Cirrus extensions
1328 	val &= 0x17;
1329 	if (val == 0x12) {
1330 	    s->vga.sr[s->vga.sr_index] = 0x12;
1331 	} else {
1332 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1333 	}
1334 	break;
1335     case 0x10:
1336     case 0x30:
1337     case 0x50:
1338     case 0x70:			// Graphics Cursor X
1339     case 0x90:
1340     case 0xb0:
1341     case 0xd0:
1342     case 0xf0:			// Graphics Cursor X
1343 	s->vga.sr[0x10] = val;
1344         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1345 	break;
1346     case 0x11:
1347     case 0x31:
1348     case 0x51:
1349     case 0x71:			// Graphics Cursor Y
1350     case 0x91:
1351     case 0xb1:
1352     case 0xd1:
1353     case 0xf1:			// Graphics Cursor Y
1354 	s->vga.sr[0x11] = val;
1355         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1356 	break;
1357     case 0x07:			// Extended Sequencer Mode
1358     cirrus_update_memory_access(s);
1359     case 0x08:			// EEPROM Control
1360     case 0x09:			// Scratch Register 0
1361     case 0x0a:			// Scratch Register 1
1362     case 0x0b:			// VCLK 0
1363     case 0x0c:			// VCLK 1
1364     case 0x0d:			// VCLK 2
1365     case 0x0e:			// VCLK 3
1366     case 0x0f:			// DRAM Control
1367     case 0x13:			// Graphics Cursor Pattern Address
1368     case 0x14:			// Scratch Register 2
1369     case 0x15:			// Scratch Register 3
1370     case 0x16:			// Performance Tuning Register
1371     case 0x18:			// Signature Generator Control
1372     case 0x19:			// Signature Generator Result
1373     case 0x1a:			// Signature Generator Result
1374     case 0x1b:			// VCLK 0 Denominator & Post
1375     case 0x1c:			// VCLK 1 Denominator & Post
1376     case 0x1d:			// VCLK 2 Denominator & Post
1377     case 0x1e:			// VCLK 3 Denominator & Post
1378     case 0x1f:			// BIOS Write Enable and MCLK select
1379 	s->vga.sr[s->vga.sr_index] = val;
1380 #ifdef DEBUG_CIRRUS
1381 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1382 	       s->vga.sr_index, val);
1383 #endif
1384 	break;
1385     case 0x12:			// Graphics Cursor Attribute
1386 	s->vga.sr[0x12] = val;
1387         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1388 #ifdef DEBUG_CIRRUS
1389         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1390                val, s->vga.force_shadow);
1391 #endif
1392         break;
1393     case 0x17:			// Configuration Readback and Extended Control
1394 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1395                                    | (val & 0xc7);
1396         cirrus_update_memory_access(s);
1397         break;
1398     default:
1399 #ifdef DEBUG_CIRRUS
1400 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1401                s->vga.sr_index, val);
1402 #endif
1403 	break;
1404     }
1405 }
1406 
1407 /***************************************
1408  *
1409  *  I/O access at 0x3c6
1410  *
1411  ***************************************/
1412 
1413 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1414 {
1415     if (++s->cirrus_hidden_dac_lockindex == 5) {
1416         s->cirrus_hidden_dac_lockindex = 0;
1417         return s->cirrus_hidden_dac_data;
1418     }
1419     return 0xff;
1420 }
1421 
1422 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1423 {
1424     if (s->cirrus_hidden_dac_lockindex == 4) {
1425 	s->cirrus_hidden_dac_data = reg_value;
1426 #if defined(DEBUG_CIRRUS)
1427 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1428 #endif
1429     }
1430     s->cirrus_hidden_dac_lockindex = 0;
1431 }
1432 
1433 /***************************************
1434  *
1435  *  I/O access at 0x3c9
1436  *
1437  ***************************************/
1438 
1439 static int cirrus_vga_read_palette(CirrusVGAState * s)
1440 {
1441     int val;
1442 
1443     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1444         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1445                                        s->vga.dac_sub_index];
1446     } else {
1447         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1448     }
1449     if (++s->vga.dac_sub_index == 3) {
1450 	s->vga.dac_sub_index = 0;
1451 	s->vga.dac_read_index++;
1452     }
1453     return val;
1454 }
1455 
1456 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1457 {
1458     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1459     if (++s->vga.dac_sub_index == 3) {
1460         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1461             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1462                    s->vga.dac_cache, 3);
1463         } else {
1464             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1465         }
1466         /* XXX update cursor */
1467 	s->vga.dac_sub_index = 0;
1468 	s->vga.dac_write_index++;
1469     }
1470 }
1471 
1472 /***************************************
1473  *
1474  *  I/O access between 0x3ce-0x3cf
1475  *
1476  ***************************************/
1477 
1478 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1479 {
1480     switch (reg_index) {
1481     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1482         return s->cirrus_shadow_gr0;
1483     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1484         return s->cirrus_shadow_gr1;
1485     case 0x02:			// Standard VGA
1486     case 0x03:			// Standard VGA
1487     case 0x04:			// Standard VGA
1488     case 0x06:			// Standard VGA
1489     case 0x07:			// Standard VGA
1490     case 0x08:			// Standard VGA
1491         return s->vga.gr[s->vga.gr_index];
1492     case 0x05:			// Standard VGA, Cirrus extended mode
1493     default:
1494 	break;
1495     }
1496 
1497     if (reg_index < 0x3a) {
1498 	return s->vga.gr[reg_index];
1499     } else {
1500 #ifdef DEBUG_CIRRUS
1501 	printf("cirrus: inport gr_index %02x\n", reg_index);
1502 #endif
1503 	return 0xff;
1504     }
1505 }
1506 
1507 static void
1508 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1509 {
1510 #if defined(DEBUG_BITBLT) && 0
1511     printf("gr%02x: %02x\n", reg_index, reg_value);
1512 #endif
1513     switch (reg_index) {
1514     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1515 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1516 	s->cirrus_shadow_gr0 = reg_value;
1517 	break;
1518     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1519 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1520 	s->cirrus_shadow_gr1 = reg_value;
1521 	break;
1522     case 0x02:			// Standard VGA
1523     case 0x03:			// Standard VGA
1524     case 0x04:			// Standard VGA
1525     case 0x06:			// Standard VGA
1526     case 0x07:			// Standard VGA
1527     case 0x08:			// Standard VGA
1528 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1529         break;
1530     case 0x05:			// Standard VGA, Cirrus extended mode
1531 	s->vga.gr[reg_index] = reg_value & 0x7f;
1532         cirrus_update_memory_access(s);
1533 	break;
1534     case 0x09:			// bank offset #0
1535     case 0x0A:			// bank offset #1
1536 	s->vga.gr[reg_index] = reg_value;
1537 	cirrus_update_bank_ptr(s, 0);
1538 	cirrus_update_bank_ptr(s, 1);
1539         cirrus_update_memory_access(s);
1540         break;
1541     case 0x0B:
1542 	s->vga.gr[reg_index] = reg_value;
1543 	cirrus_update_bank_ptr(s, 0);
1544 	cirrus_update_bank_ptr(s, 1);
1545         cirrus_update_memory_access(s);
1546 	break;
1547     case 0x10:			// BGCOLOR 0x0000ff00
1548     case 0x11:			// FGCOLOR 0x0000ff00
1549     case 0x12:			// BGCOLOR 0x00ff0000
1550     case 0x13:			// FGCOLOR 0x00ff0000
1551     case 0x14:			// BGCOLOR 0xff000000
1552     case 0x15:			// FGCOLOR 0xff000000
1553     case 0x20:			// BLT WIDTH 0x0000ff
1554     case 0x22:			// BLT HEIGHT 0x0000ff
1555     case 0x24:			// BLT DEST PITCH 0x0000ff
1556     case 0x26:			// BLT SRC PITCH 0x0000ff
1557     case 0x28:			// BLT DEST ADDR 0x0000ff
1558     case 0x29:			// BLT DEST ADDR 0x00ff00
1559     case 0x2c:			// BLT SRC ADDR 0x0000ff
1560     case 0x2d:			// BLT SRC ADDR 0x00ff00
1561     case 0x2f:                  // BLT WRITEMASK
1562     case 0x30:			// BLT MODE
1563     case 0x32:			// RASTER OP
1564     case 0x33:			// BLT MODEEXT
1565     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1566     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1567     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1568     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1569 	s->vga.gr[reg_index] = reg_value;
1570 	break;
1571     case 0x21:			// BLT WIDTH 0x001f00
1572     case 0x23:			// BLT HEIGHT 0x001f00
1573     case 0x25:			// BLT DEST PITCH 0x001f00
1574     case 0x27:			// BLT SRC PITCH 0x001f00
1575 	s->vga.gr[reg_index] = reg_value & 0x1f;
1576 	break;
1577     case 0x2a:			// BLT DEST ADDR 0x3f0000
1578 	s->vga.gr[reg_index] = reg_value & 0x3f;
1579         /* if auto start mode, starts bit blt now */
1580         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1581             cirrus_bitblt_start(s);
1582         }
1583 	break;
1584     case 0x2e:			// BLT SRC ADDR 0x3f0000
1585 	s->vga.gr[reg_index] = reg_value & 0x3f;
1586 	break;
1587     case 0x31:			// BLT STATUS/START
1588 	cirrus_write_bitblt(s, reg_value);
1589 	break;
1590     default:
1591 #ifdef DEBUG_CIRRUS
1592 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1593 	       reg_value);
1594 #endif
1595 	break;
1596     }
1597 }
1598 
1599 /***************************************
1600  *
1601  *  I/O access between 0x3d4-0x3d5
1602  *
1603  ***************************************/
1604 
1605 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1606 {
1607     switch (reg_index) {
1608     case 0x00:			// Standard VGA
1609     case 0x01:			// Standard VGA
1610     case 0x02:			// Standard VGA
1611     case 0x03:			// Standard VGA
1612     case 0x04:			// Standard VGA
1613     case 0x05:			// Standard VGA
1614     case 0x06:			// Standard VGA
1615     case 0x07:			// Standard VGA
1616     case 0x08:			// Standard VGA
1617     case 0x09:			// Standard VGA
1618     case 0x0a:			// Standard VGA
1619     case 0x0b:			// Standard VGA
1620     case 0x0c:			// Standard VGA
1621     case 0x0d:			// Standard VGA
1622     case 0x0e:			// Standard VGA
1623     case 0x0f:			// Standard VGA
1624     case 0x10:			// Standard VGA
1625     case 0x11:			// Standard VGA
1626     case 0x12:			// Standard VGA
1627     case 0x13:			// Standard VGA
1628     case 0x14:			// Standard VGA
1629     case 0x15:			// Standard VGA
1630     case 0x16:			// Standard VGA
1631     case 0x17:			// Standard VGA
1632     case 0x18:			// Standard VGA
1633 	return s->vga.cr[s->vga.cr_index];
1634     case 0x24:			// Attribute Controller Toggle Readback (R)
1635         return (s->vga.ar_flip_flop << 7);
1636     case 0x19:			// Interlace End
1637     case 0x1a:			// Miscellaneous Control
1638     case 0x1b:			// Extended Display Control
1639     case 0x1c:			// Sync Adjust and Genlock
1640     case 0x1d:			// Overlay Extended Control
1641     case 0x22:			// Graphics Data Latches Readback (R)
1642     case 0x25:			// Part Status
1643     case 0x27:			// Part ID (R)
1644 	return s->vga.cr[s->vga.cr_index];
1645     case 0x26:			// Attribute Controller Index Readback (R)
1646 	return s->vga.ar_index & 0x3f;
1647 	break;
1648     default:
1649 #ifdef DEBUG_CIRRUS
1650 	printf("cirrus: inport cr_index %02x\n", reg_index);
1651 #endif
1652 	return 0xff;
1653     }
1654 }
1655 
1656 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1657 {
1658     switch (s->vga.cr_index) {
1659     case 0x00:			// Standard VGA
1660     case 0x01:			// Standard VGA
1661     case 0x02:			// Standard VGA
1662     case 0x03:			// Standard VGA
1663     case 0x04:			// Standard VGA
1664     case 0x05:			// Standard VGA
1665     case 0x06:			// Standard VGA
1666     case 0x07:			// Standard VGA
1667     case 0x08:			// Standard VGA
1668     case 0x09:			// Standard VGA
1669     case 0x0a:			// Standard VGA
1670     case 0x0b:			// Standard VGA
1671     case 0x0c:			// Standard VGA
1672     case 0x0d:			// Standard VGA
1673     case 0x0e:			// Standard VGA
1674     case 0x0f:			// Standard VGA
1675     case 0x10:			// Standard VGA
1676     case 0x11:			// Standard VGA
1677     case 0x12:			// Standard VGA
1678     case 0x13:			// Standard VGA
1679     case 0x14:			// Standard VGA
1680     case 0x15:			// Standard VGA
1681     case 0x16:			// Standard VGA
1682     case 0x17:			// Standard VGA
1683     case 0x18:			// Standard VGA
1684 	/* handle CR0-7 protection */
1685 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1686 	    /* can always write bit 4 of CR7 */
1687 	    if (s->vga.cr_index == 7)
1688 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1689 	    return;
1690 	}
1691 	s->vga.cr[s->vga.cr_index] = reg_value;
1692 	switch(s->vga.cr_index) {
1693 	case 0x00:
1694 	case 0x04:
1695 	case 0x05:
1696 	case 0x06:
1697 	case 0x07:
1698 	case 0x11:
1699 	case 0x17:
1700 	    s->vga.update_retrace_info(&s->vga);
1701 	    break;
1702 	}
1703         break;
1704     case 0x19:			// Interlace End
1705     case 0x1a:			// Miscellaneous Control
1706     case 0x1b:			// Extended Display Control
1707     case 0x1c:			// Sync Adjust and Genlock
1708     case 0x1d:			// Overlay Extended Control
1709 	s->vga.cr[s->vga.cr_index] = reg_value;
1710 #ifdef DEBUG_CIRRUS
1711 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1712 	       s->vga.cr_index, reg_value);
1713 #endif
1714 	break;
1715     case 0x22:			// Graphics Data Latches Readback (R)
1716     case 0x24:			// Attribute Controller Toggle Readback (R)
1717     case 0x26:			// Attribute Controller Index Readback (R)
1718     case 0x27:			// Part ID (R)
1719 	break;
1720     case 0x25:			// Part Status
1721     default:
1722 #ifdef DEBUG_CIRRUS
1723 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1724                s->vga.cr_index, reg_value);
1725 #endif
1726 	break;
1727     }
1728 }
1729 
1730 /***************************************
1731  *
1732  *  memory-mapped I/O (bitblt)
1733  *
1734  ***************************************/
1735 
1736 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1737 {
1738     int value = 0xff;
1739 
1740     switch (address) {
1741     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1742 	value = cirrus_vga_read_gr(s, 0x00);
1743 	break;
1744     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1745 	value = cirrus_vga_read_gr(s, 0x10);
1746 	break;
1747     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1748 	value = cirrus_vga_read_gr(s, 0x12);
1749 	break;
1750     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1751 	value = cirrus_vga_read_gr(s, 0x14);
1752 	break;
1753     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1754 	value = cirrus_vga_read_gr(s, 0x01);
1755 	break;
1756     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1757 	value = cirrus_vga_read_gr(s, 0x11);
1758 	break;
1759     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1760 	value = cirrus_vga_read_gr(s, 0x13);
1761 	break;
1762     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1763 	value = cirrus_vga_read_gr(s, 0x15);
1764 	break;
1765     case (CIRRUS_MMIO_BLTWIDTH + 0):
1766 	value = cirrus_vga_read_gr(s, 0x20);
1767 	break;
1768     case (CIRRUS_MMIO_BLTWIDTH + 1):
1769 	value = cirrus_vga_read_gr(s, 0x21);
1770 	break;
1771     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1772 	value = cirrus_vga_read_gr(s, 0x22);
1773 	break;
1774     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1775 	value = cirrus_vga_read_gr(s, 0x23);
1776 	break;
1777     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1778 	value = cirrus_vga_read_gr(s, 0x24);
1779 	break;
1780     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1781 	value = cirrus_vga_read_gr(s, 0x25);
1782 	break;
1783     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1784 	value = cirrus_vga_read_gr(s, 0x26);
1785 	break;
1786     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1787 	value = cirrus_vga_read_gr(s, 0x27);
1788 	break;
1789     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1790 	value = cirrus_vga_read_gr(s, 0x28);
1791 	break;
1792     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1793 	value = cirrus_vga_read_gr(s, 0x29);
1794 	break;
1795     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1796 	value = cirrus_vga_read_gr(s, 0x2a);
1797 	break;
1798     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1799 	value = cirrus_vga_read_gr(s, 0x2c);
1800 	break;
1801     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1802 	value = cirrus_vga_read_gr(s, 0x2d);
1803 	break;
1804     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1805 	value = cirrus_vga_read_gr(s, 0x2e);
1806 	break;
1807     case CIRRUS_MMIO_BLTWRITEMASK:
1808 	value = cirrus_vga_read_gr(s, 0x2f);
1809 	break;
1810     case CIRRUS_MMIO_BLTMODE:
1811 	value = cirrus_vga_read_gr(s, 0x30);
1812 	break;
1813     case CIRRUS_MMIO_BLTROP:
1814 	value = cirrus_vga_read_gr(s, 0x32);
1815 	break;
1816     case CIRRUS_MMIO_BLTMODEEXT:
1817 	value = cirrus_vga_read_gr(s, 0x33);
1818 	break;
1819     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1820 	value = cirrus_vga_read_gr(s, 0x34);
1821 	break;
1822     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1823 	value = cirrus_vga_read_gr(s, 0x35);
1824 	break;
1825     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1826 	value = cirrus_vga_read_gr(s, 0x38);
1827 	break;
1828     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1829 	value = cirrus_vga_read_gr(s, 0x39);
1830 	break;
1831     case CIRRUS_MMIO_BLTSTATUS:
1832 	value = cirrus_vga_read_gr(s, 0x31);
1833 	break;
1834     default:
1835 #ifdef DEBUG_CIRRUS
1836 	printf("cirrus: mmio read - address 0x%04x\n", address);
1837 #endif
1838 	break;
1839     }
1840 
1841     return (uint8_t) value;
1842 }
1843 
1844 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1845 				  uint8_t value)
1846 {
1847     switch (address) {
1848     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1849 	cirrus_vga_write_gr(s, 0x00, value);
1850 	break;
1851     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1852 	cirrus_vga_write_gr(s, 0x10, value);
1853 	break;
1854     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1855 	cirrus_vga_write_gr(s, 0x12, value);
1856 	break;
1857     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1858 	cirrus_vga_write_gr(s, 0x14, value);
1859 	break;
1860     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1861 	cirrus_vga_write_gr(s, 0x01, value);
1862 	break;
1863     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1864 	cirrus_vga_write_gr(s, 0x11, value);
1865 	break;
1866     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1867 	cirrus_vga_write_gr(s, 0x13, value);
1868 	break;
1869     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1870 	cirrus_vga_write_gr(s, 0x15, value);
1871 	break;
1872     case (CIRRUS_MMIO_BLTWIDTH + 0):
1873 	cirrus_vga_write_gr(s, 0x20, value);
1874 	break;
1875     case (CIRRUS_MMIO_BLTWIDTH + 1):
1876 	cirrus_vga_write_gr(s, 0x21, value);
1877 	break;
1878     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1879 	cirrus_vga_write_gr(s, 0x22, value);
1880 	break;
1881     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1882 	cirrus_vga_write_gr(s, 0x23, value);
1883 	break;
1884     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1885 	cirrus_vga_write_gr(s, 0x24, value);
1886 	break;
1887     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1888 	cirrus_vga_write_gr(s, 0x25, value);
1889 	break;
1890     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1891 	cirrus_vga_write_gr(s, 0x26, value);
1892 	break;
1893     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1894 	cirrus_vga_write_gr(s, 0x27, value);
1895 	break;
1896     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1897 	cirrus_vga_write_gr(s, 0x28, value);
1898 	break;
1899     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1900 	cirrus_vga_write_gr(s, 0x29, value);
1901 	break;
1902     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1903 	cirrus_vga_write_gr(s, 0x2a, value);
1904 	break;
1905     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1906 	/* ignored */
1907 	break;
1908     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1909 	cirrus_vga_write_gr(s, 0x2c, value);
1910 	break;
1911     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1912 	cirrus_vga_write_gr(s, 0x2d, value);
1913 	break;
1914     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1915 	cirrus_vga_write_gr(s, 0x2e, value);
1916 	break;
1917     case CIRRUS_MMIO_BLTWRITEMASK:
1918 	cirrus_vga_write_gr(s, 0x2f, value);
1919 	break;
1920     case CIRRUS_MMIO_BLTMODE:
1921 	cirrus_vga_write_gr(s, 0x30, value);
1922 	break;
1923     case CIRRUS_MMIO_BLTROP:
1924 	cirrus_vga_write_gr(s, 0x32, value);
1925 	break;
1926     case CIRRUS_MMIO_BLTMODEEXT:
1927 	cirrus_vga_write_gr(s, 0x33, value);
1928 	break;
1929     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1930 	cirrus_vga_write_gr(s, 0x34, value);
1931 	break;
1932     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1933 	cirrus_vga_write_gr(s, 0x35, value);
1934 	break;
1935     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1936 	cirrus_vga_write_gr(s, 0x38, value);
1937 	break;
1938     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1939 	cirrus_vga_write_gr(s, 0x39, value);
1940 	break;
1941     case CIRRUS_MMIO_BLTSTATUS:
1942 	cirrus_vga_write_gr(s, 0x31, value);
1943 	break;
1944     default:
1945 #ifdef DEBUG_CIRRUS
1946 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1947 	       address, value);
1948 #endif
1949 	break;
1950     }
1951 }
1952 
1953 /***************************************
1954  *
1955  *  write mode 4/5
1956  *
1957  ***************************************/
1958 
1959 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1960 					     unsigned mode,
1961 					     unsigned offset,
1962 					     uint32_t mem_value)
1963 {
1964     int x;
1965     unsigned val = mem_value;
1966     uint8_t *dst;
1967 
1968     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1969     for (x = 0; x < 8; x++) {
1970 	if (val & 0x80) {
1971 	    *dst = s->cirrus_shadow_gr1;
1972 	} else if (mode == 5) {
1973 	    *dst = s->cirrus_shadow_gr0;
1974 	}
1975 	val <<= 1;
1976 	dst++;
1977     }
1978     memory_region_set_dirty(&s->vga.vram, offset, 8);
1979 }
1980 
1981 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1982 					      unsigned mode,
1983 					      unsigned offset,
1984 					      uint32_t mem_value)
1985 {
1986     int x;
1987     unsigned val = mem_value;
1988     uint8_t *dst;
1989 
1990     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1991     for (x = 0; x < 8; x++) {
1992 	if (val & 0x80) {
1993 	    *dst = s->cirrus_shadow_gr1;
1994 	    *(dst + 1) = s->vga.gr[0x11];
1995 	} else if (mode == 5) {
1996 	    *dst = s->cirrus_shadow_gr0;
1997 	    *(dst + 1) = s->vga.gr[0x10];
1998 	}
1999 	val <<= 1;
2000 	dst += 2;
2001     }
2002     memory_region_set_dirty(&s->vga.vram, offset, 16);
2003 }
2004 
2005 /***************************************
2006  *
2007  *  memory access between 0xa0000-0xbffff
2008  *
2009  ***************************************/
2010 
2011 static uint64_t cirrus_vga_mem_read(void *opaque,
2012                                     hwaddr addr,
2013                                     uint32_t size)
2014 {
2015     CirrusVGAState *s = opaque;
2016     unsigned bank_index;
2017     unsigned bank_offset;
2018     uint32_t val;
2019 
2020     if ((s->vga.sr[0x07] & 0x01) == 0) {
2021         return vga_mem_readb(&s->vga, addr);
2022     }
2023 
2024     if (addr < 0x10000) {
2025 	/* XXX handle bitblt */
2026 	/* video memory */
2027 	bank_index = addr >> 15;
2028 	bank_offset = addr & 0x7fff;
2029 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2030 	    bank_offset += s->cirrus_bank_base[bank_index];
2031 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2032 		bank_offset <<= 4;
2033 	    } else if (s->vga.gr[0x0B] & 0x02) {
2034 		bank_offset <<= 3;
2035 	    }
2036 	    bank_offset &= s->cirrus_addr_mask;
2037 	    val = *(s->vga.vram_ptr + bank_offset);
2038 	} else
2039 	    val = 0xff;
2040     } else if (addr >= 0x18000 && addr < 0x18100) {
2041 	/* memory-mapped I/O */
2042 	val = 0xff;
2043 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2044 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
2045 	}
2046     } else {
2047 	val = 0xff;
2048 #ifdef DEBUG_CIRRUS
2049 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2050 #endif
2051     }
2052     return val;
2053 }
2054 
2055 static void cirrus_vga_mem_write(void *opaque,
2056                                  hwaddr addr,
2057                                  uint64_t mem_value,
2058                                  uint32_t size)
2059 {
2060     CirrusVGAState *s = opaque;
2061     unsigned bank_index;
2062     unsigned bank_offset;
2063     unsigned mode;
2064 
2065     if ((s->vga.sr[0x07] & 0x01) == 0) {
2066         vga_mem_writeb(&s->vga, addr, mem_value);
2067         return;
2068     }
2069 
2070     if (addr < 0x10000) {
2071 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2072 	    /* bitblt */
2073 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2074 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2075 		cirrus_bitblt_cputovideo_next(s);
2076 	    }
2077 	} else {
2078 	    /* video memory */
2079 	    bank_index = addr >> 15;
2080 	    bank_offset = addr & 0x7fff;
2081 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2082 		bank_offset += s->cirrus_bank_base[bank_index];
2083 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2084 		    bank_offset <<= 4;
2085 		} else if (s->vga.gr[0x0B] & 0x02) {
2086 		    bank_offset <<= 3;
2087 		}
2088 		bank_offset &= s->cirrus_addr_mask;
2089 		mode = s->vga.gr[0x05] & 0x7;
2090 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2091 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2092                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2093                                             sizeof(mem_value));
2094 		} else {
2095 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2096 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2097 							 bank_offset,
2098 							 mem_value);
2099 		    } else {
2100 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2101 							  bank_offset,
2102 							  mem_value);
2103 		    }
2104 		}
2105 	    }
2106 	}
2107     } else if (addr >= 0x18000 && addr < 0x18100) {
2108 	/* memory-mapped I/O */
2109 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2110 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2111 	}
2112     } else {
2113 #ifdef DEBUG_CIRRUS
2114         printf("cirrus: mem_writeb " TARGET_FMT_plx " value 0x%02" PRIu64 "\n", addr,
2115                mem_value);
2116 #endif
2117     }
2118 }
2119 
2120 static const MemoryRegionOps cirrus_vga_mem_ops = {
2121     .read = cirrus_vga_mem_read,
2122     .write = cirrus_vga_mem_write,
2123     .endianness = DEVICE_LITTLE_ENDIAN,
2124     .impl = {
2125         .min_access_size = 1,
2126         .max_access_size = 1,
2127     },
2128 };
2129 
2130 /***************************************
2131  *
2132  *  hardware cursor
2133  *
2134  ***************************************/
2135 
2136 static inline void invalidate_cursor1(CirrusVGAState *s)
2137 {
2138     if (s->last_hw_cursor_size) {
2139         vga_invalidate_scanlines(&s->vga,
2140                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2141                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2142     }
2143 }
2144 
2145 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2146 {
2147     const uint8_t *src;
2148     uint32_t content;
2149     int y, y_min, y_max;
2150 
2151     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2152     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2153         src += (s->vga.sr[0x13] & 0x3c) * 256;
2154         y_min = 64;
2155         y_max = -1;
2156         for(y = 0; y < 64; y++) {
2157             content = ((uint32_t *)src)[0] |
2158                 ((uint32_t *)src)[1] |
2159                 ((uint32_t *)src)[2] |
2160                 ((uint32_t *)src)[3];
2161             if (content) {
2162                 if (y < y_min)
2163                     y_min = y;
2164                 if (y > y_max)
2165                     y_max = y;
2166             }
2167             src += 16;
2168         }
2169     } else {
2170         src += (s->vga.sr[0x13] & 0x3f) * 256;
2171         y_min = 32;
2172         y_max = -1;
2173         for(y = 0; y < 32; y++) {
2174             content = ((uint32_t *)src)[0] |
2175                 ((uint32_t *)(src + 128))[0];
2176             if (content) {
2177                 if (y < y_min)
2178                     y_min = y;
2179                 if (y > y_max)
2180                     y_max = y;
2181             }
2182             src += 4;
2183         }
2184     }
2185     if (y_min > y_max) {
2186         s->last_hw_cursor_y_start = 0;
2187         s->last_hw_cursor_y_end = 0;
2188     } else {
2189         s->last_hw_cursor_y_start = y_min;
2190         s->last_hw_cursor_y_end = y_max + 1;
2191     }
2192 }
2193 
2194 /* NOTE: we do not currently handle the cursor bitmap change, so we
2195    update the cursor only if it moves. */
2196 static void cirrus_cursor_invalidate(VGACommonState *s1)
2197 {
2198     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2199     int size;
2200 
2201     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2202         size = 0;
2203     } else {
2204         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2205             size = 64;
2206         else
2207             size = 32;
2208     }
2209     /* invalidate last cursor and new cursor if any change */
2210     if (s->last_hw_cursor_size != size ||
2211         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2212         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2213 
2214         invalidate_cursor1(s);
2215 
2216         s->last_hw_cursor_size = size;
2217         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2218         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2219         /* compute the real cursor min and max y */
2220         cirrus_cursor_compute_yrange(s);
2221         invalidate_cursor1(s);
2222     }
2223 }
2224 
2225 static void vga_draw_cursor_line(uint8_t *d1,
2226                                  const uint8_t *src1,
2227                                  int poffset, int w,
2228                                  unsigned int color0,
2229                                  unsigned int color1,
2230                                  unsigned int color_xor)
2231 {
2232     const uint8_t *plane0, *plane1;
2233     int x, b0, b1;
2234     uint8_t *d;
2235 
2236     d = d1;
2237     plane0 = src1;
2238     plane1 = src1 + poffset;
2239     for (x = 0; x < w; x++) {
2240         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2241         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2242         switch (b0 | (b1 << 1)) {
2243         case 0:
2244             break;
2245         case 1:
2246             ((uint32_t *)d)[0] ^= color_xor;
2247             break;
2248         case 2:
2249             ((uint32_t *)d)[0] = color0;
2250             break;
2251         case 3:
2252             ((uint32_t *)d)[0] = color1;
2253             break;
2254         }
2255         d += 4;
2256     }
2257 }
2258 
2259 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2260 {
2261     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2262     int w, h, x1, x2, poffset;
2263     unsigned int color0, color1;
2264     const uint8_t *palette, *src;
2265     uint32_t content;
2266 
2267     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2268         return;
2269     /* fast test to see if the cursor intersects with the scan line */
2270     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2271         h = 64;
2272     } else {
2273         h = 32;
2274     }
2275     if (scr_y < s->vga.hw_cursor_y ||
2276         scr_y >= (s->vga.hw_cursor_y + h)) {
2277         return;
2278     }
2279 
2280     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2281     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2282         src += (s->vga.sr[0x13] & 0x3c) * 256;
2283         src += (scr_y - s->vga.hw_cursor_y) * 16;
2284         poffset = 8;
2285         content = ((uint32_t *)src)[0] |
2286             ((uint32_t *)src)[1] |
2287             ((uint32_t *)src)[2] |
2288             ((uint32_t *)src)[3];
2289     } else {
2290         src += (s->vga.sr[0x13] & 0x3f) * 256;
2291         src += (scr_y - s->vga.hw_cursor_y) * 4;
2292 
2293 
2294         poffset = 128;
2295         content = ((uint32_t *)src)[0] |
2296             ((uint32_t *)(src + 128))[0];
2297     }
2298     /* if nothing to draw, no need to continue */
2299     if (!content)
2300         return;
2301     w = h;
2302 
2303     x1 = s->vga.hw_cursor_x;
2304     if (x1 >= s->vga.last_scr_width)
2305         return;
2306     x2 = s->vga.hw_cursor_x + w;
2307     if (x2 > s->vga.last_scr_width)
2308         x2 = s->vga.last_scr_width;
2309     w = x2 - x1;
2310     palette = s->cirrus_hidden_palette;
2311     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2312                             c6_to_8(palette[0x0 * 3 + 1]),
2313                             c6_to_8(palette[0x0 * 3 + 2]));
2314     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2315                             c6_to_8(palette[0xf * 3 + 1]),
2316                             c6_to_8(palette[0xf * 3 + 2]));
2317     d1 += x1 * 4;
2318     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2319 }
2320 
2321 /***************************************
2322  *
2323  *  LFB memory access
2324  *
2325  ***************************************/
2326 
2327 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2328                                    unsigned size)
2329 {
2330     CirrusVGAState *s = opaque;
2331     uint32_t ret;
2332 
2333     addr &= s->cirrus_addr_mask;
2334 
2335     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2336         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2337 	/* memory-mapped I/O */
2338 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2339     } else if (0) {
2340 	/* XXX handle bitblt */
2341 	ret = 0xff;
2342     } else {
2343 	/* video memory */
2344 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2345 	    addr <<= 4;
2346 	} else if (s->vga.gr[0x0B] & 0x02) {
2347 	    addr <<= 3;
2348 	}
2349 	addr &= s->cirrus_addr_mask;
2350 	ret = *(s->vga.vram_ptr + addr);
2351     }
2352 
2353     return ret;
2354 }
2355 
2356 static void cirrus_linear_write(void *opaque, hwaddr addr,
2357                                 uint64_t val, unsigned size)
2358 {
2359     CirrusVGAState *s = opaque;
2360     unsigned mode;
2361 
2362     addr &= s->cirrus_addr_mask;
2363 
2364     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2365         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2366 	/* memory-mapped I/O */
2367 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2368     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2369 	/* bitblt */
2370 	*s->cirrus_srcptr++ = (uint8_t) val;
2371 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2372 	    cirrus_bitblt_cputovideo_next(s);
2373 	}
2374     } else {
2375 	/* video memory */
2376 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2377 	    addr <<= 4;
2378 	} else if (s->vga.gr[0x0B] & 0x02) {
2379 	    addr <<= 3;
2380 	}
2381 	addr &= s->cirrus_addr_mask;
2382 
2383 	mode = s->vga.gr[0x05] & 0x7;
2384 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2385 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2386             memory_region_set_dirty(&s->vga.vram, addr, 1);
2387 	} else {
2388 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2389 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2390 	    } else {
2391 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2392 	    }
2393 	}
2394     }
2395 }
2396 
2397 /***************************************
2398  *
2399  *  system to screen memory access
2400  *
2401  ***************************************/
2402 
2403 
2404 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2405                                           hwaddr addr,
2406                                           unsigned size)
2407 {
2408     CirrusVGAState *s = opaque;
2409     uint32_t ret;
2410 
2411     /* XXX handle bitblt */
2412     (void)s;
2413     ret = 0xff;
2414     return ret;
2415 }
2416 
2417 static void cirrus_linear_bitblt_write(void *opaque,
2418                                        hwaddr addr,
2419                                        uint64_t val,
2420                                        unsigned size)
2421 {
2422     CirrusVGAState *s = opaque;
2423 
2424     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2425 	/* bitblt */
2426 	*s->cirrus_srcptr++ = (uint8_t) val;
2427 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2428 	    cirrus_bitblt_cputovideo_next(s);
2429 	}
2430     }
2431 }
2432 
2433 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2434     .read = cirrus_linear_bitblt_read,
2435     .write = cirrus_linear_bitblt_write,
2436     .endianness = DEVICE_LITTLE_ENDIAN,
2437     .impl = {
2438         .min_access_size = 1,
2439         .max_access_size = 1,
2440     },
2441 };
2442 
2443 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2444 {
2445     MemoryRegion *mr = &s->cirrus_bank[bank];
2446     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2447         && !((s->vga.sr[0x07] & 0x01) == 0)
2448         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2449         && !(s->vga.gr[0x0B] & 0x02);
2450 
2451     memory_region_set_enabled(mr, enabled);
2452     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2453 }
2454 
2455 static void map_linear_vram(CirrusVGAState *s)
2456 {
2457     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2458         s->linear_vram = true;
2459         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2460     }
2461     map_linear_vram_bank(s, 0);
2462     map_linear_vram_bank(s, 1);
2463 }
2464 
2465 static void unmap_linear_vram(CirrusVGAState *s)
2466 {
2467     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2468         s->linear_vram = false;
2469         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2470     }
2471     memory_region_set_enabled(&s->cirrus_bank[0], false);
2472     memory_region_set_enabled(&s->cirrus_bank[1], false);
2473 }
2474 
2475 /* Compute the memory access functions */
2476 static void cirrus_update_memory_access(CirrusVGAState *s)
2477 {
2478     unsigned mode;
2479 
2480     memory_region_transaction_begin();
2481     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2482         goto generic_io;
2483     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2484         goto generic_io;
2485     } else {
2486 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2487             goto generic_io;
2488 	} else if (s->vga.gr[0x0B] & 0x02) {
2489             goto generic_io;
2490         }
2491 
2492 	mode = s->vga.gr[0x05] & 0x7;
2493 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2494             map_linear_vram(s);
2495         } else {
2496         generic_io:
2497             unmap_linear_vram(s);
2498         }
2499     }
2500     memory_region_transaction_commit();
2501 }
2502 
2503 
2504 /* I/O ports */
2505 
2506 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2507                                        unsigned size)
2508 {
2509     CirrusVGAState *c = opaque;
2510     VGACommonState *s = &c->vga;
2511     int val, index;
2512 
2513     addr += 0x3b0;
2514 
2515     if (vga_ioport_invalid(s, addr)) {
2516 	val = 0xff;
2517     } else {
2518 	switch (addr) {
2519 	case 0x3c0:
2520 	    if (s->ar_flip_flop == 0) {
2521 		val = s->ar_index;
2522 	    } else {
2523 		val = 0;
2524 	    }
2525 	    break;
2526 	case 0x3c1:
2527 	    index = s->ar_index & 0x1f;
2528 	    if (index < 21)
2529 		val = s->ar[index];
2530 	    else
2531 		val = 0;
2532 	    break;
2533 	case 0x3c2:
2534 	    val = s->st00;
2535 	    break;
2536 	case 0x3c4:
2537 	    val = s->sr_index;
2538 	    break;
2539 	case 0x3c5:
2540 	    val = cirrus_vga_read_sr(c);
2541             break;
2542 #ifdef DEBUG_VGA_REG
2543 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2544 #endif
2545 	    break;
2546 	case 0x3c6:
2547 	    val = cirrus_read_hidden_dac(c);
2548 	    break;
2549 	case 0x3c7:
2550 	    val = s->dac_state;
2551 	    break;
2552 	case 0x3c8:
2553 	    val = s->dac_write_index;
2554 	    c->cirrus_hidden_dac_lockindex = 0;
2555 	    break;
2556         case 0x3c9:
2557             val = cirrus_vga_read_palette(c);
2558             break;
2559 	case 0x3ca:
2560 	    val = s->fcr;
2561 	    break;
2562 	case 0x3cc:
2563 	    val = s->msr;
2564 	    break;
2565 	case 0x3ce:
2566 	    val = s->gr_index;
2567 	    break;
2568 	case 0x3cf:
2569 	    val = cirrus_vga_read_gr(c, s->gr_index);
2570 #ifdef DEBUG_VGA_REG
2571 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2572 #endif
2573 	    break;
2574 	case 0x3b4:
2575 	case 0x3d4:
2576 	    val = s->cr_index;
2577 	    break;
2578 	case 0x3b5:
2579 	case 0x3d5:
2580             val = cirrus_vga_read_cr(c, s->cr_index);
2581 #ifdef DEBUG_VGA_REG
2582 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2583 #endif
2584 	    break;
2585 	case 0x3ba:
2586 	case 0x3da:
2587 	    /* just toggle to fool polling */
2588 	    val = s->st01 = s->retrace(s);
2589 	    s->ar_flip_flop = 0;
2590 	    break;
2591 	default:
2592 	    val = 0x00;
2593 	    break;
2594 	}
2595     }
2596 #if defined(DEBUG_VGA)
2597     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
2598 #endif
2599     return val;
2600 }
2601 
2602 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2603                                     unsigned size)
2604 {
2605     CirrusVGAState *c = opaque;
2606     VGACommonState *s = &c->vga;
2607     int index;
2608 
2609     addr += 0x3b0;
2610 
2611     /* check port range access depending on color/monochrome mode */
2612     if (vga_ioport_invalid(s, addr)) {
2613 	return;
2614     }
2615 #ifdef DEBUG_VGA
2616     printf("VGA: write addr=0x%04x data=0x%02x\n", addr, val);
2617 #endif
2618 
2619     switch (addr) {
2620     case 0x3c0:
2621 	if (s->ar_flip_flop == 0) {
2622 	    val &= 0x3f;
2623 	    s->ar_index = val;
2624 	} else {
2625 	    index = s->ar_index & 0x1f;
2626 	    switch (index) {
2627 	    case 0x00 ... 0x0f:
2628 		s->ar[index] = val & 0x3f;
2629 		break;
2630 	    case 0x10:
2631 		s->ar[index] = val & ~0x10;
2632 		break;
2633 	    case 0x11:
2634 		s->ar[index] = val;
2635 		break;
2636 	    case 0x12:
2637 		s->ar[index] = val & ~0xc0;
2638 		break;
2639 	    case 0x13:
2640 		s->ar[index] = val & ~0xf0;
2641 		break;
2642 	    case 0x14:
2643 		s->ar[index] = val & ~0xf0;
2644 		break;
2645 	    default:
2646 		break;
2647 	    }
2648 	}
2649 	s->ar_flip_flop ^= 1;
2650 	break;
2651     case 0x3c2:
2652 	s->msr = val & ~0x10;
2653 	s->update_retrace_info(s);
2654 	break;
2655     case 0x3c4:
2656 	s->sr_index = val;
2657 	break;
2658     case 0x3c5:
2659 #ifdef DEBUG_VGA_REG
2660 	printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2661 #endif
2662 	cirrus_vga_write_sr(c, val);
2663         break;
2664     case 0x3c6:
2665 	cirrus_write_hidden_dac(c, val);
2666 	break;
2667     case 0x3c7:
2668 	s->dac_read_index = val;
2669 	s->dac_sub_index = 0;
2670 	s->dac_state = 3;
2671 	break;
2672     case 0x3c8:
2673 	s->dac_write_index = val;
2674 	s->dac_sub_index = 0;
2675 	s->dac_state = 0;
2676 	break;
2677     case 0x3c9:
2678         cirrus_vga_write_palette(c, val);
2679         break;
2680     case 0x3ce:
2681 	s->gr_index = val;
2682 	break;
2683     case 0x3cf:
2684 #ifdef DEBUG_VGA_REG
2685 	printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2686 #endif
2687 	cirrus_vga_write_gr(c, s->gr_index, val);
2688 	break;
2689     case 0x3b4:
2690     case 0x3d4:
2691 	s->cr_index = val;
2692 	break;
2693     case 0x3b5:
2694     case 0x3d5:
2695 #ifdef DEBUG_VGA_REG
2696 	printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2697 #endif
2698 	cirrus_vga_write_cr(c, val);
2699 	break;
2700     case 0x3ba:
2701     case 0x3da:
2702 	s->fcr = val & 0x10;
2703 	break;
2704     }
2705 }
2706 
2707 /***************************************
2708  *
2709  *  memory-mapped I/O access
2710  *
2711  ***************************************/
2712 
2713 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2714                                  unsigned size)
2715 {
2716     CirrusVGAState *s = opaque;
2717 
2718     if (addr >= 0x100) {
2719         return cirrus_mmio_blt_read(s, addr - 0x100);
2720     } else {
2721         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2722     }
2723 }
2724 
2725 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2726                               uint64_t val, unsigned size)
2727 {
2728     CirrusVGAState *s = opaque;
2729 
2730     if (addr >= 0x100) {
2731 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2732     } else {
2733         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2734     }
2735 }
2736 
2737 static const MemoryRegionOps cirrus_mmio_io_ops = {
2738     .read = cirrus_mmio_read,
2739     .write = cirrus_mmio_write,
2740     .endianness = DEVICE_LITTLE_ENDIAN,
2741     .impl = {
2742         .min_access_size = 1,
2743         .max_access_size = 1,
2744     },
2745 };
2746 
2747 /* load/save state */
2748 
2749 static int cirrus_post_load(void *opaque, int version_id)
2750 {
2751     CirrusVGAState *s = opaque;
2752 
2753     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2754     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2755 
2756     cirrus_update_memory_access(s);
2757     /* force refresh */
2758     s->vga.graphic_mode = -1;
2759     cirrus_update_bank_ptr(s, 0);
2760     cirrus_update_bank_ptr(s, 1);
2761     return 0;
2762 }
2763 
2764 static const VMStateDescription vmstate_cirrus_vga = {
2765     .name = "cirrus_vga",
2766     .version_id = 2,
2767     .minimum_version_id = 1,
2768     .post_load = cirrus_post_load,
2769     .fields = (VMStateField[]) {
2770         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2771         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2772         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2773         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2774         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2775         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2776         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2777         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2778         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2779         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2780         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2781         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2782         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2783         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2784         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2785         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2786         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2787         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2788         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2789         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2790         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2791         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2792         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2793         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2794         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2795         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2796         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2797         /* XXX: we do not save the bitblt state - we assume we do not save
2798            the state when the blitter is active */
2799         VMSTATE_END_OF_LIST()
2800     }
2801 };
2802 
2803 static const VMStateDescription vmstate_pci_cirrus_vga = {
2804     .name = "cirrus_vga",
2805     .version_id = 2,
2806     .minimum_version_id = 2,
2807     .fields = (VMStateField[]) {
2808         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2809         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2810                        vmstate_cirrus_vga, CirrusVGAState),
2811         VMSTATE_END_OF_LIST()
2812     }
2813 };
2814 
2815 /***************************************
2816  *
2817  *  initialize
2818  *
2819  ***************************************/
2820 
2821 static void cirrus_reset(void *opaque)
2822 {
2823     CirrusVGAState *s = opaque;
2824 
2825     vga_common_reset(&s->vga);
2826     unmap_linear_vram(s);
2827     s->vga.sr[0x06] = 0x0f;
2828     if (s->device_id == CIRRUS_ID_CLGD5446) {
2829         /* 4MB 64 bit memory config, always PCI */
2830         s->vga.sr[0x1F] = 0x2d;		// MemClock
2831         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2832         s->vga.sr[0x0f] = 0x98;
2833         s->vga.sr[0x17] = 0x20;
2834         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2835     } else {
2836         s->vga.sr[0x1F] = 0x22;		// MemClock
2837         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2838         s->vga.sr[0x17] = s->bustype;
2839         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2840     }
2841     s->vga.cr[0x27] = s->device_id;
2842 
2843     s->cirrus_hidden_dac_lockindex = 5;
2844     s->cirrus_hidden_dac_data = 0;
2845 }
2846 
2847 static const MemoryRegionOps cirrus_linear_io_ops = {
2848     .read = cirrus_linear_read,
2849     .write = cirrus_linear_write,
2850     .endianness = DEVICE_LITTLE_ENDIAN,
2851     .impl = {
2852         .min_access_size = 1,
2853         .max_access_size = 1,
2854     },
2855 };
2856 
2857 static const MemoryRegionOps cirrus_vga_io_ops = {
2858     .read = cirrus_vga_ioport_read,
2859     .write = cirrus_vga_ioport_write,
2860     .endianness = DEVICE_LITTLE_ENDIAN,
2861     .impl = {
2862         .min_access_size = 1,
2863         .max_access_size = 1,
2864     },
2865 };
2866 
2867 static void cirrus_init_common(CirrusVGAState *s, Object *owner,
2868                                int device_id, int is_pci,
2869                                MemoryRegion *system_memory,
2870                                MemoryRegion *system_io)
2871 {
2872     int i;
2873     static int inited;
2874 
2875     if (!inited) {
2876         inited = 1;
2877         for(i = 0;i < 256; i++)
2878             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2879         rop_to_index[CIRRUS_ROP_0] = 0;
2880         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2881         rop_to_index[CIRRUS_ROP_NOP] = 2;
2882         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2883         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2884         rop_to_index[CIRRUS_ROP_SRC] = 5;
2885         rop_to_index[CIRRUS_ROP_1] = 6;
2886         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2887         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2888         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2889         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2890         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2891         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2892         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2893         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2894         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2895         s->device_id = device_id;
2896         if (is_pci)
2897             s->bustype = CIRRUS_BUSTYPE_PCI;
2898         else
2899             s->bustype = CIRRUS_BUSTYPE_ISA;
2900     }
2901 
2902     /* Register ioport 0x3b0 - 0x3df */
2903     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2904                           "cirrus-io", 0x30);
2905     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2906     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2907 
2908     memory_region_init(&s->low_mem_container, owner,
2909                        "cirrus-lowmem-container",
2910                        0x20000);
2911 
2912     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2913                           "cirrus-low-memory", 0x20000);
2914     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2915     for (i = 0; i < 2; ++i) {
2916         static const char *names[] = { "vga.bank0", "vga.bank1" };
2917         MemoryRegion *bank = &s->cirrus_bank[i];
2918         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2919                                  0, 0x8000);
2920         memory_region_set_enabled(bank, false);
2921         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2922                                             bank, 1);
2923     }
2924     memory_region_add_subregion_overlap(system_memory,
2925                                         0x000a0000,
2926                                         &s->low_mem_container,
2927                                         1);
2928     memory_region_set_coalescing(&s->low_mem);
2929 
2930     /* I/O handler for LFB */
2931     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2932                           "cirrus-linear-io", s->vga.vram_size_mb
2933                                               * 1024 * 1024);
2934     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2935 
2936     /* I/O handler for LFB */
2937     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2938                           &cirrus_linear_bitblt_io_ops,
2939                           s,
2940                           "cirrus-bitblt-mmio",
2941                           0x400000);
2942     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2943 
2944     /* I/O handler for memory-mapped I/O */
2945     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2946                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2947     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2948 
2949     s->real_vram_size =
2950         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
2951 
2952     /* XXX: s->vga.vram_size must be a power of two */
2953     s->cirrus_addr_mask = s->real_vram_size - 1;
2954     s->linear_mmio_mask = s->real_vram_size - 256;
2955 
2956     s->vga.get_bpp = cirrus_get_bpp;
2957     s->vga.get_offsets = cirrus_get_offsets;
2958     s->vga.get_resolution = cirrus_get_resolution;
2959     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2960     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2961 
2962     qemu_register_reset(cirrus_reset, s);
2963 }
2964 
2965 /***************************************
2966  *
2967  *  ISA bus support
2968  *
2969  ***************************************/
2970 
2971 static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
2972 {
2973     ISADevice *isadev = ISA_DEVICE(dev);
2974     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
2975     VGACommonState *s = &d->cirrus_vga.vga;
2976 
2977     /* follow real hardware, cirrus card emulated has 4 MB video memory.
2978        Also accept 8 MB/16 MB for backward compatibility. */
2979     if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&
2980         s->vram_size_mb != 16) {
2981         error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2982                    s->vram_size_mb);
2983         return;
2984     }
2985     vga_common_init(s, OBJECT(dev), true);
2986     cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
2987                        isa_address_space(isadev),
2988                        isa_address_space_io(isadev));
2989     s->con = graphic_console_init(dev, 0, s->hw_ops, s);
2990     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
2991     /* XXX ISA-LFB support */
2992     /* FIXME not qdev yet */
2993 }
2994 
2995 static Property isa_cirrus_vga_properties[] = {
2996     DEFINE_PROP_UINT32("vgamem_mb", struct ISACirrusVGAState,
2997                        cirrus_vga.vga.vram_size_mb, 8),
2998     DEFINE_PROP_END_OF_LIST(),
2999 };
3000 
3001 static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
3002 {
3003     DeviceClass *dc = DEVICE_CLASS(klass);
3004 
3005     dc->vmsd  = &vmstate_cirrus_vga;
3006     dc->realize = isa_cirrus_vga_realizefn;
3007     dc->props = isa_cirrus_vga_properties;
3008     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3009 }
3010 
3011 static const TypeInfo isa_cirrus_vga_info = {
3012     .name          = TYPE_ISA_CIRRUS_VGA,
3013     .parent        = TYPE_ISA_DEVICE,
3014     .instance_size = sizeof(ISACirrusVGAState),
3015     .class_init = isa_cirrus_vga_class_init,
3016 };
3017 
3018 /***************************************
3019  *
3020  *  PCI bus support
3021  *
3022  ***************************************/
3023 
3024 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
3025 {
3026      PCICirrusVGAState *d = PCI_CIRRUS_VGA(dev);
3027      CirrusVGAState *s = &d->cirrus_vga;
3028      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
3029      int16_t device_id = pc->device_id;
3030 
3031      /* follow real hardware, cirrus card emulated has 4 MB video memory.
3032        Also accept 8 MB/16 MB for backward compatibility. */
3033      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
3034          s->vga.vram_size_mb != 16) {
3035          error_setg(errp, "Invalid cirrus_vga ram size '%u'",
3036                     s->vga.vram_size_mb);
3037          return;
3038      }
3039      /* setup VGA */
3040      vga_common_init(&s->vga, OBJECT(dev), true);
3041      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
3042                         pci_address_space_io(dev));
3043      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
3044 
3045      /* setup PCI */
3046 
3047     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
3048 
3049     /* XXX: add byte swapping apertures */
3050     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
3051     memory_region_add_subregion(&s->pci_bar, 0x1000000,
3052                                 &s->cirrus_linear_bitblt_io);
3053 
3054      /* setup memory space */
3055      /* memory #0 LFB */
3056      /* memory #1 memory-mapped I/O */
3057      /* XXX: s->vga.vram_size must be a power of two */
3058      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
3059      if (device_id == CIRRUS_ID_CLGD5446) {
3060          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
3061      }
3062 }
3063 
3064 static Property pci_vga_cirrus_properties[] = {
3065     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
3066                        cirrus_vga.vga.vram_size_mb, 8),
3067     DEFINE_PROP_END_OF_LIST(),
3068 };
3069 
3070 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3071 {
3072     DeviceClass *dc = DEVICE_CLASS(klass);
3073     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3074 
3075     k->realize = pci_cirrus_vga_realize;
3076     k->romfile = VGABIOS_CIRRUS_FILENAME;
3077     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3078     k->device_id = CIRRUS_ID_CLGD5446;
3079     k->class_id = PCI_CLASS_DISPLAY_VGA;
3080     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3081     dc->desc = "Cirrus CLGD 54xx VGA";
3082     dc->vmsd = &vmstate_pci_cirrus_vga;
3083     dc->props = pci_vga_cirrus_properties;
3084     dc->hotpluggable = false;
3085 }
3086 
3087 static const TypeInfo cirrus_vga_info = {
3088     .name          = TYPE_PCI_CIRRUS_VGA,
3089     .parent        = TYPE_PCI_DEVICE,
3090     .instance_size = sizeof(PCICirrusVGAState),
3091     .class_init    = cirrus_vga_class_init,
3092 };
3093 
3094 static void cirrus_vga_register_types(void)
3095 {
3096     type_register_static(&isa_cirrus_vga_info);
3097     type_register_static(&cirrus_vga_info);
3098 }
3099 
3100 type_init(cirrus_vga_register_types)
3101