xref: /qemu/hw/display/cirrus_vga.c (revision 226419d6)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "qemu/osdep.h"
30 #include "hw/hw.h"
31 #include "hw/pci/pci.h"
32 #include "ui/console.h"
33 #include "ui/pixel_ops.h"
34 #include "vga_int.h"
35 #include "hw/loader.h"
36 
37 /*
38  * TODO:
39  *    - destination write mask support not complete (bits 5..7)
40  *    - optimize linear mappings
41  *    - optimize bitblt functions
42  */
43 
44 //#define DEBUG_CIRRUS
45 //#define DEBUG_BITBLT
46 
47 /***************************************
48  *
49  *  definitions
50  *
51  ***************************************/
52 
53 // ID
54 #define CIRRUS_ID_CLGD5422  (0x23<<2)
55 #define CIRRUS_ID_CLGD5426  (0x24<<2)
56 #define CIRRUS_ID_CLGD5424  (0x25<<2)
57 #define CIRRUS_ID_CLGD5428  (0x26<<2)
58 #define CIRRUS_ID_CLGD5430  (0x28<<2)
59 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
60 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
61 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
62 
63 // sequencer 0x07
64 #define CIRRUS_SR7_BPP_VGA            0x00
65 #define CIRRUS_SR7_BPP_SVGA           0x01
66 #define CIRRUS_SR7_BPP_MASK           0x0e
67 #define CIRRUS_SR7_BPP_8              0x00
68 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
69 #define CIRRUS_SR7_BPP_24             0x04
70 #define CIRRUS_SR7_BPP_16             0x06
71 #define CIRRUS_SR7_BPP_32             0x08
72 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
73 
74 // sequencer 0x0f
75 #define CIRRUS_MEMSIZE_512k        0x08
76 #define CIRRUS_MEMSIZE_1M          0x10
77 #define CIRRUS_MEMSIZE_2M          0x18
78 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80	// bank switching is enabled.
79 
80 // sequencer 0x12
81 #define CIRRUS_CURSOR_SHOW         0x01
82 #define CIRRUS_CURSOR_HIDDENPEL    0x02
83 #define CIRRUS_CURSOR_LARGE        0x04	// 64x64 if set, 32x32 if clear
84 
85 // sequencer 0x17
86 #define CIRRUS_BUSTYPE_VLBFAST   0x10
87 #define CIRRUS_BUSTYPE_PCI       0x20
88 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
89 #define CIRRUS_BUSTYPE_ISA       0x38
90 #define CIRRUS_MMIO_ENABLE       0x04
91 #define CIRRUS_MMIO_USE_PCIADDR  0x40	// 0xb8000 if cleared.
92 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
93 
94 // control 0x0b
95 #define CIRRUS_BANKING_DUAL             0x01
96 #define CIRRUS_BANKING_GRANULARITY_16K  0x20	// set:16k, clear:4k
97 
98 // control 0x30
99 #define CIRRUS_BLTMODE_BACKWARDS        0x01
100 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
101 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
102 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
103 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
104 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
105 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
106 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
107 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
108 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
109 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
110 
111 // control 0x31
112 #define CIRRUS_BLT_BUSY                 0x01
113 #define CIRRUS_BLT_START                0x02
114 #define CIRRUS_BLT_RESET                0x04
115 #define CIRRUS_BLT_FIFOUSED             0x10
116 #define CIRRUS_BLT_AUTOSTART            0x80
117 
118 // control 0x32
119 #define CIRRUS_ROP_0                    0x00
120 #define CIRRUS_ROP_SRC_AND_DST          0x05
121 #define CIRRUS_ROP_NOP                  0x06
122 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
123 #define CIRRUS_ROP_NOTDST               0x0b
124 #define CIRRUS_ROP_SRC                  0x0d
125 #define CIRRUS_ROP_1                    0x0e
126 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
127 #define CIRRUS_ROP_SRC_XOR_DST          0x59
128 #define CIRRUS_ROP_SRC_OR_DST           0x6d
129 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
130 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
131 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
132 #define CIRRUS_ROP_NOTSRC               0xd0
133 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
134 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
135 
136 #define CIRRUS_ROP_NOP_INDEX 2
137 #define CIRRUS_ROP_SRC_INDEX 5
138 
139 // control 0x33
140 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
141 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
142 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
143 
144 // memory-mapped IO
145 #define CIRRUS_MMIO_BLTBGCOLOR        0x00	// dword
146 #define CIRRUS_MMIO_BLTFGCOLOR        0x04	// dword
147 #define CIRRUS_MMIO_BLTWIDTH          0x08	// word
148 #define CIRRUS_MMIO_BLTHEIGHT         0x0a	// word
149 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c	// word
150 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e	// word
151 #define CIRRUS_MMIO_BLTDESTADDR       0x10	// dword
152 #define CIRRUS_MMIO_BLTSRCADDR        0x14	// dword
153 #define CIRRUS_MMIO_BLTWRITEMASK      0x17	// byte
154 #define CIRRUS_MMIO_BLTMODE           0x18	// byte
155 #define CIRRUS_MMIO_BLTROP            0x1a	// byte
156 #define CIRRUS_MMIO_BLTMODEEXT        0x1b	// byte
157 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c	// word?
158 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20	// word?
159 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24	// word
160 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26	// word
161 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28	// word
162 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a	// word
163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c	// byte
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d	// byte
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e	// byte
166 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f	// byte
167 #define CIRRUS_MMIO_BRESENHAM_K1      0x30	// word
168 #define CIRRUS_MMIO_BRESENHAM_K3      0x32	// word
169 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34	// word
170 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36	// word
171 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38	// byte
172 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39	// byte
173 #define CIRRUS_MMIO_BLTSTATUS         0x40	// byte
174 
175 #define CIRRUS_PNPMMIO_SIZE         0x1000
176 
177 struct CirrusVGAState;
178 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
179                                      uint8_t * dst, const uint8_t * src,
180 				     int dstpitch, int srcpitch,
181 				     int bltwidth, int bltheight);
182 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
183                               uint8_t *dst, int dst_pitch, int width, int height);
184 
185 typedef struct CirrusVGAState {
186     VGACommonState vga;
187 
188     MemoryRegion cirrus_vga_io;
189     MemoryRegion cirrus_linear_io;
190     MemoryRegion cirrus_linear_bitblt_io;
191     MemoryRegion cirrus_mmio_io;
192     MemoryRegion pci_bar;
193     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
194     MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
195     MemoryRegion low_mem;           /* always mapped, overridden by: */
196     MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
197     uint32_t cirrus_addr_mask;
198     uint32_t linear_mmio_mask;
199     uint8_t cirrus_shadow_gr0;
200     uint8_t cirrus_shadow_gr1;
201     uint8_t cirrus_hidden_dac_lockindex;
202     uint8_t cirrus_hidden_dac_data;
203     uint32_t cirrus_bank_base[2];
204     uint32_t cirrus_bank_limit[2];
205     uint8_t cirrus_hidden_palette[48];
206     int cirrus_blt_pixelwidth;
207     int cirrus_blt_width;
208     int cirrus_blt_height;
209     int cirrus_blt_dstpitch;
210     int cirrus_blt_srcpitch;
211     uint32_t cirrus_blt_fgcol;
212     uint32_t cirrus_blt_bgcol;
213     uint32_t cirrus_blt_dstaddr;
214     uint32_t cirrus_blt_srcaddr;
215     uint8_t cirrus_blt_mode;
216     uint8_t cirrus_blt_modeext;
217     cirrus_bitblt_rop_t cirrus_rop;
218 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
219     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
220     uint8_t *cirrus_srcptr;
221     uint8_t *cirrus_srcptr_end;
222     uint32_t cirrus_srccounter;
223     /* hwcursor display state */
224     int last_hw_cursor_size;
225     int last_hw_cursor_x;
226     int last_hw_cursor_y;
227     int last_hw_cursor_y_start;
228     int last_hw_cursor_y_end;
229     int real_vram_size; /* XXX: suppress that */
230     int device_id;
231     int bustype;
232 } CirrusVGAState;
233 
234 typedef struct PCICirrusVGAState {
235     PCIDevice dev;
236     CirrusVGAState cirrus_vga;
237 } PCICirrusVGAState;
238 
239 #define TYPE_PCI_CIRRUS_VGA "cirrus-vga"
240 #define PCI_CIRRUS_VGA(obj) \
241     OBJECT_CHECK(PCICirrusVGAState, (obj), TYPE_PCI_CIRRUS_VGA)
242 
243 #define TYPE_ISA_CIRRUS_VGA "isa-cirrus-vga"
244 #define ISA_CIRRUS_VGA(obj) \
245     OBJECT_CHECK(ISACirrusVGAState, (obj), TYPE_ISA_CIRRUS_VGA)
246 
247 typedef struct ISACirrusVGAState {
248     ISADevice parent_obj;
249 
250     CirrusVGAState cirrus_vga;
251 } ISACirrusVGAState;
252 
253 static uint8_t rop_to_index[256];
254 
255 /***************************************
256  *
257  *  prototypes.
258  *
259  ***************************************/
260 
261 
262 static void cirrus_bitblt_reset(CirrusVGAState *s);
263 static void cirrus_update_memory_access(CirrusVGAState *s);
264 
265 /***************************************
266  *
267  *  raster operations
268  *
269  ***************************************/
270 
271 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
272                                   int32_t pitch, int32_t addr)
273 {
274     if (pitch < 0) {
275         int64_t min = addr
276             + ((int64_t)s->cirrus_blt_height-1) * pitch;
277         int32_t max = addr
278             + s->cirrus_blt_width;
279         if (min < 0 || max > s->vga.vram_size) {
280             return true;
281         }
282     } else {
283         int64_t max = addr
284             + ((int64_t)s->cirrus_blt_height-1) * pitch
285             + s->cirrus_blt_width;
286         if (max > s->vga.vram_size) {
287             return true;
288         }
289     }
290     return false;
291 }
292 
293 static bool blit_is_unsafe(struct CirrusVGAState *s)
294 {
295     /* should be the case, see cirrus_bitblt_start */
296     assert(s->cirrus_blt_width > 0);
297     assert(s->cirrus_blt_height > 0);
298 
299     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
300         return true;
301     }
302 
303     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
304                               s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
305         return true;
306     }
307     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
308                               s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
309         return true;
310     }
311 
312     return false;
313 }
314 
315 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
316                                   uint8_t *dst,const uint8_t *src,
317                                   int dstpitch,int srcpitch,
318                                   int bltwidth,int bltheight)
319 {
320 }
321 
322 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
323                                    uint8_t *dst,
324                                    int dstpitch, int bltwidth,int bltheight)
325 {
326 }
327 
328 #define ROP_NAME 0
329 #define ROP_FN(d, s) 0
330 #include "cirrus_vga_rop.h"
331 
332 #define ROP_NAME src_and_dst
333 #define ROP_FN(d, s) (s) & (d)
334 #include "cirrus_vga_rop.h"
335 
336 #define ROP_NAME src_and_notdst
337 #define ROP_FN(d, s) (s) & (~(d))
338 #include "cirrus_vga_rop.h"
339 
340 #define ROP_NAME notdst
341 #define ROP_FN(d, s) ~(d)
342 #include "cirrus_vga_rop.h"
343 
344 #define ROP_NAME src
345 #define ROP_FN(d, s) s
346 #include "cirrus_vga_rop.h"
347 
348 #define ROP_NAME 1
349 #define ROP_FN(d, s) ~0
350 #include "cirrus_vga_rop.h"
351 
352 #define ROP_NAME notsrc_and_dst
353 #define ROP_FN(d, s) (~(s)) & (d)
354 #include "cirrus_vga_rop.h"
355 
356 #define ROP_NAME src_xor_dst
357 #define ROP_FN(d, s) (s) ^ (d)
358 #include "cirrus_vga_rop.h"
359 
360 #define ROP_NAME src_or_dst
361 #define ROP_FN(d, s) (s) | (d)
362 #include "cirrus_vga_rop.h"
363 
364 #define ROP_NAME notsrc_or_notdst
365 #define ROP_FN(d, s) (~(s)) | (~(d))
366 #include "cirrus_vga_rop.h"
367 
368 #define ROP_NAME src_notxor_dst
369 #define ROP_FN(d, s) ~((s) ^ (d))
370 #include "cirrus_vga_rop.h"
371 
372 #define ROP_NAME src_or_notdst
373 #define ROP_FN(d, s) (s) | (~(d))
374 #include "cirrus_vga_rop.h"
375 
376 #define ROP_NAME notsrc
377 #define ROP_FN(d, s) (~(s))
378 #include "cirrus_vga_rop.h"
379 
380 #define ROP_NAME notsrc_or_dst
381 #define ROP_FN(d, s) (~(s)) | (d)
382 #include "cirrus_vga_rop.h"
383 
384 #define ROP_NAME notsrc_and_notdst
385 #define ROP_FN(d, s) (~(s)) & (~(d))
386 #include "cirrus_vga_rop.h"
387 
388 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
389     cirrus_bitblt_rop_fwd_0,
390     cirrus_bitblt_rop_fwd_src_and_dst,
391     cirrus_bitblt_rop_nop,
392     cirrus_bitblt_rop_fwd_src_and_notdst,
393     cirrus_bitblt_rop_fwd_notdst,
394     cirrus_bitblt_rop_fwd_src,
395     cirrus_bitblt_rop_fwd_1,
396     cirrus_bitblt_rop_fwd_notsrc_and_dst,
397     cirrus_bitblt_rop_fwd_src_xor_dst,
398     cirrus_bitblt_rop_fwd_src_or_dst,
399     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
400     cirrus_bitblt_rop_fwd_src_notxor_dst,
401     cirrus_bitblt_rop_fwd_src_or_notdst,
402     cirrus_bitblt_rop_fwd_notsrc,
403     cirrus_bitblt_rop_fwd_notsrc_or_dst,
404     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
405 };
406 
407 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
408     cirrus_bitblt_rop_bkwd_0,
409     cirrus_bitblt_rop_bkwd_src_and_dst,
410     cirrus_bitblt_rop_nop,
411     cirrus_bitblt_rop_bkwd_src_and_notdst,
412     cirrus_bitblt_rop_bkwd_notdst,
413     cirrus_bitblt_rop_bkwd_src,
414     cirrus_bitblt_rop_bkwd_1,
415     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
416     cirrus_bitblt_rop_bkwd_src_xor_dst,
417     cirrus_bitblt_rop_bkwd_src_or_dst,
418     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
419     cirrus_bitblt_rop_bkwd_src_notxor_dst,
420     cirrus_bitblt_rop_bkwd_src_or_notdst,
421     cirrus_bitblt_rop_bkwd_notsrc,
422     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
423     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
424 };
425 
426 #define TRANSP_ROP(name) {\
427     name ## _8,\
428     name ## _16,\
429         }
430 #define TRANSP_NOP(func) {\
431     func,\
432     func,\
433         }
434 
435 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
436     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
437     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
438     TRANSP_NOP(cirrus_bitblt_rop_nop),
439     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
440     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
441     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
442     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
443     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
444     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
445     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
446     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
447     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
448     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
449     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
450     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
451     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
452 };
453 
454 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
455     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
456     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
457     TRANSP_NOP(cirrus_bitblt_rop_nop),
458     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
459     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
460     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
461     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
462     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
463     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
464     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
465     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
466     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
467     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
468     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
469     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
470     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
471 };
472 
473 #define ROP2(name) {\
474     name ## _8,\
475     name ## _16,\
476     name ## _24,\
477     name ## _32,\
478         }
479 
480 #define ROP_NOP2(func) {\
481     func,\
482     func,\
483     func,\
484     func,\
485         }
486 
487 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
488     ROP2(cirrus_patternfill_0),
489     ROP2(cirrus_patternfill_src_and_dst),
490     ROP_NOP2(cirrus_bitblt_rop_nop),
491     ROP2(cirrus_patternfill_src_and_notdst),
492     ROP2(cirrus_patternfill_notdst),
493     ROP2(cirrus_patternfill_src),
494     ROP2(cirrus_patternfill_1),
495     ROP2(cirrus_patternfill_notsrc_and_dst),
496     ROP2(cirrus_patternfill_src_xor_dst),
497     ROP2(cirrus_patternfill_src_or_dst),
498     ROP2(cirrus_patternfill_notsrc_or_notdst),
499     ROP2(cirrus_patternfill_src_notxor_dst),
500     ROP2(cirrus_patternfill_src_or_notdst),
501     ROP2(cirrus_patternfill_notsrc),
502     ROP2(cirrus_patternfill_notsrc_or_dst),
503     ROP2(cirrus_patternfill_notsrc_and_notdst),
504 };
505 
506 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
507     ROP2(cirrus_colorexpand_transp_0),
508     ROP2(cirrus_colorexpand_transp_src_and_dst),
509     ROP_NOP2(cirrus_bitblt_rop_nop),
510     ROP2(cirrus_colorexpand_transp_src_and_notdst),
511     ROP2(cirrus_colorexpand_transp_notdst),
512     ROP2(cirrus_colorexpand_transp_src),
513     ROP2(cirrus_colorexpand_transp_1),
514     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
515     ROP2(cirrus_colorexpand_transp_src_xor_dst),
516     ROP2(cirrus_colorexpand_transp_src_or_dst),
517     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
518     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
519     ROP2(cirrus_colorexpand_transp_src_or_notdst),
520     ROP2(cirrus_colorexpand_transp_notsrc),
521     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
522     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
523 };
524 
525 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
526     ROP2(cirrus_colorexpand_0),
527     ROP2(cirrus_colorexpand_src_and_dst),
528     ROP_NOP2(cirrus_bitblt_rop_nop),
529     ROP2(cirrus_colorexpand_src_and_notdst),
530     ROP2(cirrus_colorexpand_notdst),
531     ROP2(cirrus_colorexpand_src),
532     ROP2(cirrus_colorexpand_1),
533     ROP2(cirrus_colorexpand_notsrc_and_dst),
534     ROP2(cirrus_colorexpand_src_xor_dst),
535     ROP2(cirrus_colorexpand_src_or_dst),
536     ROP2(cirrus_colorexpand_notsrc_or_notdst),
537     ROP2(cirrus_colorexpand_src_notxor_dst),
538     ROP2(cirrus_colorexpand_src_or_notdst),
539     ROP2(cirrus_colorexpand_notsrc),
540     ROP2(cirrus_colorexpand_notsrc_or_dst),
541     ROP2(cirrus_colorexpand_notsrc_and_notdst),
542 };
543 
544 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
545     ROP2(cirrus_colorexpand_pattern_transp_0),
546     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
547     ROP_NOP2(cirrus_bitblt_rop_nop),
548     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
549     ROP2(cirrus_colorexpand_pattern_transp_notdst),
550     ROP2(cirrus_colorexpand_pattern_transp_src),
551     ROP2(cirrus_colorexpand_pattern_transp_1),
552     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
553     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
554     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
555     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
556     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
557     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
558     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
559     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
560     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
561 };
562 
563 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
564     ROP2(cirrus_colorexpand_pattern_0),
565     ROP2(cirrus_colorexpand_pattern_src_and_dst),
566     ROP_NOP2(cirrus_bitblt_rop_nop),
567     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
568     ROP2(cirrus_colorexpand_pattern_notdst),
569     ROP2(cirrus_colorexpand_pattern_src),
570     ROP2(cirrus_colorexpand_pattern_1),
571     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
572     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
573     ROP2(cirrus_colorexpand_pattern_src_or_dst),
574     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
575     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
576     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
577     ROP2(cirrus_colorexpand_pattern_notsrc),
578     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
579     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
580 };
581 
582 static const cirrus_fill_t cirrus_fill[16][4] = {
583     ROP2(cirrus_fill_0),
584     ROP2(cirrus_fill_src_and_dst),
585     ROP_NOP2(cirrus_bitblt_fill_nop),
586     ROP2(cirrus_fill_src_and_notdst),
587     ROP2(cirrus_fill_notdst),
588     ROP2(cirrus_fill_src),
589     ROP2(cirrus_fill_1),
590     ROP2(cirrus_fill_notsrc_and_dst),
591     ROP2(cirrus_fill_src_xor_dst),
592     ROP2(cirrus_fill_src_or_dst),
593     ROP2(cirrus_fill_notsrc_or_notdst),
594     ROP2(cirrus_fill_src_notxor_dst),
595     ROP2(cirrus_fill_src_or_notdst),
596     ROP2(cirrus_fill_notsrc),
597     ROP2(cirrus_fill_notsrc_or_dst),
598     ROP2(cirrus_fill_notsrc_and_notdst),
599 };
600 
601 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
602 {
603     unsigned int color;
604     switch (s->cirrus_blt_pixelwidth) {
605     case 1:
606         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
607         break;
608     case 2:
609         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
610         s->cirrus_blt_fgcol = le16_to_cpu(color);
611         break;
612     case 3:
613         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
614             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
615         break;
616     default:
617     case 4:
618         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
619             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
620         s->cirrus_blt_fgcol = le32_to_cpu(color);
621         break;
622     }
623 }
624 
625 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
626 {
627     unsigned int color;
628     switch (s->cirrus_blt_pixelwidth) {
629     case 1:
630         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
631         break;
632     case 2:
633         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
634         s->cirrus_blt_bgcol = le16_to_cpu(color);
635         break;
636     case 3:
637         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
638             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
639         break;
640     default:
641     case 4:
642         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
643             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
644         s->cirrus_blt_bgcol = le32_to_cpu(color);
645         break;
646     }
647 }
648 
649 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
650 				     int off_pitch, int bytesperline,
651 				     int lines)
652 {
653     int y;
654     int off_cur;
655     int off_cur_end;
656 
657     for (y = 0; y < lines; y++) {
658 	off_cur = off_begin;
659 	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
660         memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
661 	off_begin += off_pitch;
662     }
663 }
664 
665 static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
666 					    const uint8_t * src)
667 {
668     uint8_t *dst;
669 
670     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
671 
672     if (blit_is_unsafe(s))
673         return 0;
674 
675     (*s->cirrus_rop) (s, dst, src,
676                       s->cirrus_blt_dstpitch, 0,
677                       s->cirrus_blt_width, s->cirrus_blt_height);
678     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
679                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
680                              s->cirrus_blt_height);
681     return 1;
682 }
683 
684 /* fill */
685 
686 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
687 {
688     cirrus_fill_t rop_func;
689 
690     if (blit_is_unsafe(s)) {
691         return 0;
692     }
693     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
694     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
695              s->cirrus_blt_dstpitch,
696              s->cirrus_blt_width, s->cirrus_blt_height);
697     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
698 			     s->cirrus_blt_dstpitch, s->cirrus_blt_width,
699 			     s->cirrus_blt_height);
700     cirrus_bitblt_reset(s);
701     return 1;
702 }
703 
704 /***************************************
705  *
706  *  bitblt (video-to-video)
707  *
708  ***************************************/
709 
710 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
711 {
712     return cirrus_bitblt_common_patterncopy(s,
713 					    s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
714                                             s->cirrus_addr_mask));
715 }
716 
717 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
718 {
719     int sx = 0, sy = 0;
720     int dx = 0, dy = 0;
721     int depth = 0;
722     int notify = 0;
723 
724     /* make sure to only copy if it's a plain copy ROP */
725     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
726         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
727 
728         int width, height;
729 
730         depth = s->vga.get_bpp(&s->vga) / 8;
731         s->vga.get_resolution(&s->vga, &width, &height);
732 
733         /* extra x, y */
734         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
735         sy = (src / ABS(s->cirrus_blt_srcpitch));
736         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
737         dy = (dst / ABS(s->cirrus_blt_dstpitch));
738 
739         /* normalize width */
740         w /= depth;
741 
742         /* if we're doing a backward copy, we have to adjust
743            our x/y to be the upper left corner (instead of the lower
744            right corner) */
745         if (s->cirrus_blt_dstpitch < 0) {
746             sx -= (s->cirrus_blt_width / depth) - 1;
747             dx -= (s->cirrus_blt_width / depth) - 1;
748             sy -= s->cirrus_blt_height - 1;
749             dy -= s->cirrus_blt_height - 1;
750         }
751 
752         /* are we in the visible portion of memory? */
753         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
754             (sx + w) <= width && (sy + h) <= height &&
755             (dx + w) <= width && (dy + h) <= height) {
756             notify = 1;
757         }
758     }
759 
760     /* we have to flush all pending changes so that the copy
761        is generated at the appropriate moment in time */
762     if (notify)
763         graphic_hw_update(s->vga.con);
764 
765     (*s->cirrus_rop) (s, s->vga.vram_ptr +
766 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
767 		      s->vga.vram_ptr +
768 		      (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
769 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
770 		      s->cirrus_blt_width, s->cirrus_blt_height);
771 
772     if (notify) {
773         qemu_console_copy(s->vga.con,
774 			  sx, sy, dx, dy,
775 			  s->cirrus_blt_width / depth,
776 			  s->cirrus_blt_height);
777     }
778 
779     /* we don't have to notify the display that this portion has
780        changed since qemu_console_copy implies this */
781 
782     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
783 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
784 				s->cirrus_blt_height);
785 }
786 
787 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
788 {
789     if (blit_is_unsafe(s))
790         return 0;
791 
792     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
793             s->cirrus_blt_srcaddr - s->vga.start_addr,
794             s->cirrus_blt_width, s->cirrus_blt_height);
795 
796     return 1;
797 }
798 
799 /***************************************
800  *
801  *  bitblt (cpu-to-video)
802  *
803  ***************************************/
804 
805 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
806 {
807     int copy_count;
808     uint8_t *end_ptr;
809 
810     if (s->cirrus_srccounter > 0) {
811         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
812             cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);
813         the_end:
814             s->cirrus_srccounter = 0;
815             cirrus_bitblt_reset(s);
816         } else {
817             /* at least one scan line */
818             do {
819                 (*s->cirrus_rop)(s, s->vga.vram_ptr +
820                                  (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
821                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
822                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
823                                          s->cirrus_blt_width, 1);
824                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
825                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
826                 if (s->cirrus_srccounter <= 0)
827                     goto the_end;
828                 /* more bytes than needed can be transferred because of
829                    word alignment, so we keep them for the next line */
830                 /* XXX: keep alignment to speed up transfer */
831                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
832                 copy_count = s->cirrus_srcptr_end - end_ptr;
833                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
834                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
835                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
836             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
837         }
838     }
839 }
840 
841 /***************************************
842  *
843  *  bitblt wrapper
844  *
845  ***************************************/
846 
847 static void cirrus_bitblt_reset(CirrusVGAState * s)
848 {
849     int need_update;
850 
851     s->vga.gr[0x31] &=
852 	~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
853     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
854         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
855     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
856     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
857     s->cirrus_srccounter = 0;
858     if (!need_update)
859         return;
860     cirrus_update_memory_access(s);
861 }
862 
863 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
864 {
865     int w;
866 
867     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
868     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
869     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
870 
871     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
872 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
873 	    s->cirrus_blt_srcpitch = 8;
874 	} else {
875             /* XXX: check for 24 bpp */
876 	    s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
877 	}
878 	s->cirrus_srccounter = s->cirrus_blt_srcpitch;
879     } else {
880 	if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
881             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
882             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
883                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
884             else
885                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
886 	} else {
887             /* always align input size to 32 bits */
888 	    s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
889 	}
890         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
891     }
892     s->cirrus_srcptr = s->cirrus_bltbuf;
893     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
894     cirrus_update_memory_access(s);
895     return 1;
896 }
897 
898 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
899 {
900     /* XXX */
901 #ifdef DEBUG_BITBLT
902     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
903 #endif
904     return 0;
905 }
906 
907 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
908 {
909     int ret;
910 
911     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
912 	ret = cirrus_bitblt_videotovideo_patterncopy(s);
913     } else {
914 	ret = cirrus_bitblt_videotovideo_copy(s);
915     }
916     if (ret)
917 	cirrus_bitblt_reset(s);
918     return ret;
919 }
920 
921 static void cirrus_bitblt_start(CirrusVGAState * s)
922 {
923     uint8_t blt_rop;
924 
925     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
926 
927     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
928     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
929     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
930     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
931     s->cirrus_blt_dstaddr =
932 	(s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
933     s->cirrus_blt_srcaddr =
934 	(s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
935     s->cirrus_blt_mode = s->vga.gr[0x30];
936     s->cirrus_blt_modeext = s->vga.gr[0x33];
937     blt_rop = s->vga.gr[0x32];
938 
939 #ifdef DEBUG_BITBLT
940     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
941            blt_rop,
942            s->cirrus_blt_mode,
943            s->cirrus_blt_modeext,
944            s->cirrus_blt_width,
945            s->cirrus_blt_height,
946            s->cirrus_blt_dstpitch,
947            s->cirrus_blt_srcpitch,
948            s->cirrus_blt_dstaddr,
949            s->cirrus_blt_srcaddr,
950            s->vga.gr[0x2f]);
951 #endif
952 
953     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
954     case CIRRUS_BLTMODE_PIXELWIDTH8:
955 	s->cirrus_blt_pixelwidth = 1;
956 	break;
957     case CIRRUS_BLTMODE_PIXELWIDTH16:
958 	s->cirrus_blt_pixelwidth = 2;
959 	break;
960     case CIRRUS_BLTMODE_PIXELWIDTH24:
961 	s->cirrus_blt_pixelwidth = 3;
962 	break;
963     case CIRRUS_BLTMODE_PIXELWIDTH32:
964 	s->cirrus_blt_pixelwidth = 4;
965 	break;
966     default:
967 #ifdef DEBUG_BITBLT
968 	printf("cirrus: bitblt - pixel width is unknown\n");
969 #endif
970 	goto bitblt_ignore;
971     }
972     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
973 
974     if ((s->
975 	 cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
976 			    CIRRUS_BLTMODE_MEMSYSDEST))
977 	== (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
978 #ifdef DEBUG_BITBLT
979 	printf("cirrus: bitblt - memory-to-memory copy is requested\n");
980 #endif
981 	goto bitblt_ignore;
982     }
983 
984     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
985         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
986                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
987                                CIRRUS_BLTMODE_PATTERNCOPY |
988                                CIRRUS_BLTMODE_COLOREXPAND)) ==
989          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
990         cirrus_bitblt_fgcol(s);
991         cirrus_bitblt_solidfill(s, blt_rop);
992     } else {
993         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
994                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
995             CIRRUS_BLTMODE_COLOREXPAND) {
996 
997             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
998                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
999                     cirrus_bitblt_bgcol(s);
1000                 else
1001                     cirrus_bitblt_fgcol(s);
1002                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1003             } else {
1004                 cirrus_bitblt_fgcol(s);
1005                 cirrus_bitblt_bgcol(s);
1006                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1007             }
1008         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1009             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1010                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1011                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1012                         cirrus_bitblt_bgcol(s);
1013                     else
1014                         cirrus_bitblt_fgcol(s);
1015                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1016                 } else {
1017                     cirrus_bitblt_fgcol(s);
1018                     cirrus_bitblt_bgcol(s);
1019                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1020                 }
1021             } else {
1022                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1023             }
1024         } else {
1025 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1026 		if (s->cirrus_blt_pixelwidth > 2) {
1027 		    printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1028 		    goto bitblt_ignore;
1029 		}
1030 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1031 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1032 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1033 		    s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1034 		} else {
1035 		    s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1036 		}
1037 	    } else {
1038 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1039 		    s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1040 		    s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1041 		    s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1042 		} else {
1043 		    s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1044 		}
1045 	    }
1046 	}
1047         // setup bitblt engine.
1048         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1049             if (!cirrus_bitblt_cputovideo(s))
1050                 goto bitblt_ignore;
1051         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1052             if (!cirrus_bitblt_videotocpu(s))
1053                 goto bitblt_ignore;
1054         } else {
1055             if (!cirrus_bitblt_videotovideo(s))
1056                 goto bitblt_ignore;
1057         }
1058     }
1059     return;
1060   bitblt_ignore:;
1061     cirrus_bitblt_reset(s);
1062 }
1063 
1064 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1065 {
1066     unsigned old_value;
1067 
1068     old_value = s->vga.gr[0x31];
1069     s->vga.gr[0x31] = reg_value;
1070 
1071     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1072 	((reg_value & CIRRUS_BLT_RESET) == 0)) {
1073 	cirrus_bitblt_reset(s);
1074     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1075 	       ((reg_value & CIRRUS_BLT_START) != 0)) {
1076 	cirrus_bitblt_start(s);
1077     }
1078 }
1079 
1080 
1081 /***************************************
1082  *
1083  *  basic parameters
1084  *
1085  ***************************************/
1086 
1087 static void cirrus_get_offsets(VGACommonState *s1,
1088                                uint32_t *pline_offset,
1089                                uint32_t *pstart_addr,
1090                                uint32_t *pline_compare)
1091 {
1092     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1093     uint32_t start_addr, line_offset, line_compare;
1094 
1095     line_offset = s->vga.cr[0x13]
1096 	| ((s->vga.cr[0x1b] & 0x10) << 4);
1097     line_offset <<= 3;
1098     *pline_offset = line_offset;
1099 
1100     start_addr = (s->vga.cr[0x0c] << 8)
1101 	| s->vga.cr[0x0d]
1102 	| ((s->vga.cr[0x1b] & 0x01) << 16)
1103 	| ((s->vga.cr[0x1b] & 0x0c) << 15)
1104 	| ((s->vga.cr[0x1d] & 0x80) << 12);
1105     *pstart_addr = start_addr;
1106 
1107     line_compare = s->vga.cr[0x18] |
1108         ((s->vga.cr[0x07] & 0x10) << 4) |
1109         ((s->vga.cr[0x09] & 0x40) << 3);
1110     *pline_compare = line_compare;
1111 }
1112 
1113 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1114 {
1115     uint32_t ret = 16;
1116 
1117     switch (s->cirrus_hidden_dac_data & 0xf) {
1118     case 0:
1119 	ret = 15;
1120 	break;			/* Sierra HiColor */
1121     case 1:
1122 	ret = 16;
1123 	break;			/* XGA HiColor */
1124     default:
1125 #ifdef DEBUG_CIRRUS
1126 	printf("cirrus: invalid DAC value %x in 16bpp\n",
1127 	       (s->cirrus_hidden_dac_data & 0xf));
1128 #endif
1129 	ret = 15;		/* XXX */
1130 	break;
1131     }
1132     return ret;
1133 }
1134 
1135 static int cirrus_get_bpp(VGACommonState *s1)
1136 {
1137     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1138     uint32_t ret = 8;
1139 
1140     if ((s->vga.sr[0x07] & 0x01) != 0) {
1141 	/* Cirrus SVGA */
1142 	switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1143 	case CIRRUS_SR7_BPP_8:
1144 	    ret = 8;
1145 	    break;
1146 	case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1147 	    ret = cirrus_get_bpp16_depth(s);
1148 	    break;
1149 	case CIRRUS_SR7_BPP_24:
1150 	    ret = 24;
1151 	    break;
1152 	case CIRRUS_SR7_BPP_16:
1153 	    ret = cirrus_get_bpp16_depth(s);
1154 	    break;
1155 	case CIRRUS_SR7_BPP_32:
1156 	    ret = 32;
1157 	    break;
1158 	default:
1159 #ifdef DEBUG_CIRRUS
1160 	    printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1161 #endif
1162 	    ret = 8;
1163 	    break;
1164 	}
1165     } else {
1166 	/* VGA */
1167 	ret = 0;
1168     }
1169 
1170     return ret;
1171 }
1172 
1173 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1174 {
1175     int width, height;
1176 
1177     width = (s->cr[0x01] + 1) * 8;
1178     height = s->cr[0x12] |
1179         ((s->cr[0x07] & 0x02) << 7) |
1180         ((s->cr[0x07] & 0x40) << 3);
1181     height = (height + 1);
1182     /* interlace support */
1183     if (s->cr[0x1a] & 0x01)
1184         height = height * 2;
1185     *pwidth = width;
1186     *pheight = height;
1187 }
1188 
1189 /***************************************
1190  *
1191  * bank memory
1192  *
1193  ***************************************/
1194 
1195 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1196 {
1197     unsigned offset;
1198     unsigned limit;
1199 
1200     if ((s->vga.gr[0x0b] & 0x01) != 0)	/* dual bank */
1201 	offset = s->vga.gr[0x09 + bank_index];
1202     else			/* single bank */
1203 	offset = s->vga.gr[0x09];
1204 
1205     if ((s->vga.gr[0x0b] & 0x20) != 0)
1206 	offset <<= 14;
1207     else
1208 	offset <<= 12;
1209 
1210     if (s->real_vram_size <= offset)
1211 	limit = 0;
1212     else
1213 	limit = s->real_vram_size - offset;
1214 
1215     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1216 	if (limit > 0x8000) {
1217 	    offset += 0x8000;
1218 	    limit -= 0x8000;
1219 	} else {
1220 	    limit = 0;
1221 	}
1222     }
1223 
1224     if (limit > 0) {
1225 	s->cirrus_bank_base[bank_index] = offset;
1226 	s->cirrus_bank_limit[bank_index] = limit;
1227     } else {
1228 	s->cirrus_bank_base[bank_index] = 0;
1229 	s->cirrus_bank_limit[bank_index] = 0;
1230     }
1231 }
1232 
1233 /***************************************
1234  *
1235  *  I/O access between 0x3c4-0x3c5
1236  *
1237  ***************************************/
1238 
1239 static int cirrus_vga_read_sr(CirrusVGAState * s)
1240 {
1241     switch (s->vga.sr_index) {
1242     case 0x00:			// Standard VGA
1243     case 0x01:			// Standard VGA
1244     case 0x02:			// Standard VGA
1245     case 0x03:			// Standard VGA
1246     case 0x04:			// Standard VGA
1247 	return s->vga.sr[s->vga.sr_index];
1248     case 0x06:			// Unlock Cirrus extensions
1249 	return s->vga.sr[s->vga.sr_index];
1250     case 0x10:
1251     case 0x30:
1252     case 0x50:
1253     case 0x70:			// Graphics Cursor X
1254     case 0x90:
1255     case 0xb0:
1256     case 0xd0:
1257     case 0xf0:			// Graphics Cursor X
1258 	return s->vga.sr[0x10];
1259     case 0x11:
1260     case 0x31:
1261     case 0x51:
1262     case 0x71:			// Graphics Cursor Y
1263     case 0x91:
1264     case 0xb1:
1265     case 0xd1:
1266     case 0xf1:			// Graphics Cursor Y
1267 	return s->vga.sr[0x11];
1268     case 0x05:			// ???
1269     case 0x07:			// Extended Sequencer Mode
1270     case 0x08:			// EEPROM Control
1271     case 0x09:			// Scratch Register 0
1272     case 0x0a:			// Scratch Register 1
1273     case 0x0b:			// VCLK 0
1274     case 0x0c:			// VCLK 1
1275     case 0x0d:			// VCLK 2
1276     case 0x0e:			// VCLK 3
1277     case 0x0f:			// DRAM Control
1278     case 0x12:			// Graphics Cursor Attribute
1279     case 0x13:			// Graphics Cursor Pattern Address
1280     case 0x14:			// Scratch Register 2
1281     case 0x15:			// Scratch Register 3
1282     case 0x16:			// Performance Tuning Register
1283     case 0x17:			// Configuration Readback and Extended Control
1284     case 0x18:			// Signature Generator Control
1285     case 0x19:			// Signal Generator Result
1286     case 0x1a:			// Signal Generator Result
1287     case 0x1b:			// VCLK 0 Denominator & Post
1288     case 0x1c:			// VCLK 1 Denominator & Post
1289     case 0x1d:			// VCLK 2 Denominator & Post
1290     case 0x1e:			// VCLK 3 Denominator & Post
1291     case 0x1f:			// BIOS Write Enable and MCLK select
1292 #ifdef DEBUG_CIRRUS
1293 	printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1294 #endif
1295 	return s->vga.sr[s->vga.sr_index];
1296     default:
1297 #ifdef DEBUG_CIRRUS
1298 	printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1299 #endif
1300 	return 0xff;
1301 	break;
1302     }
1303 }
1304 
1305 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1306 {
1307     switch (s->vga.sr_index) {
1308     case 0x00:			// Standard VGA
1309     case 0x01:			// Standard VGA
1310     case 0x02:			// Standard VGA
1311     case 0x03:			// Standard VGA
1312     case 0x04:			// Standard VGA
1313 	s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1314 	if (s->vga.sr_index == 1)
1315             s->vga.update_retrace_info(&s->vga);
1316         break;
1317     case 0x06:			// Unlock Cirrus extensions
1318 	val &= 0x17;
1319 	if (val == 0x12) {
1320 	    s->vga.sr[s->vga.sr_index] = 0x12;
1321 	} else {
1322 	    s->vga.sr[s->vga.sr_index] = 0x0f;
1323 	}
1324 	break;
1325     case 0x10:
1326     case 0x30:
1327     case 0x50:
1328     case 0x70:			// Graphics Cursor X
1329     case 0x90:
1330     case 0xb0:
1331     case 0xd0:
1332     case 0xf0:			// Graphics Cursor X
1333 	s->vga.sr[0x10] = val;
1334         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1335 	break;
1336     case 0x11:
1337     case 0x31:
1338     case 0x51:
1339     case 0x71:			// Graphics Cursor Y
1340     case 0x91:
1341     case 0xb1:
1342     case 0xd1:
1343     case 0xf1:			// Graphics Cursor Y
1344 	s->vga.sr[0x11] = val;
1345         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1346 	break;
1347     case 0x07:			// Extended Sequencer Mode
1348     cirrus_update_memory_access(s);
1349     case 0x08:			// EEPROM Control
1350     case 0x09:			// Scratch Register 0
1351     case 0x0a:			// Scratch Register 1
1352     case 0x0b:			// VCLK 0
1353     case 0x0c:			// VCLK 1
1354     case 0x0d:			// VCLK 2
1355     case 0x0e:			// VCLK 3
1356     case 0x0f:			// DRAM Control
1357     case 0x13:			// Graphics Cursor Pattern Address
1358     case 0x14:			// Scratch Register 2
1359     case 0x15:			// Scratch Register 3
1360     case 0x16:			// Performance Tuning Register
1361     case 0x18:			// Signature Generator Control
1362     case 0x19:			// Signature Generator Result
1363     case 0x1a:			// Signature Generator Result
1364     case 0x1b:			// VCLK 0 Denominator & Post
1365     case 0x1c:			// VCLK 1 Denominator & Post
1366     case 0x1d:			// VCLK 2 Denominator & Post
1367     case 0x1e:			// VCLK 3 Denominator & Post
1368     case 0x1f:			// BIOS Write Enable and MCLK select
1369 	s->vga.sr[s->vga.sr_index] = val;
1370 #ifdef DEBUG_CIRRUS
1371 	printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1372 	       s->vga.sr_index, val);
1373 #endif
1374 	break;
1375     case 0x12:			// Graphics Cursor Attribute
1376 	s->vga.sr[0x12] = val;
1377         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1378 #ifdef DEBUG_CIRRUS
1379         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1380                val, s->vga.force_shadow);
1381 #endif
1382         break;
1383     case 0x17:			// Configuration Readback and Extended Control
1384 	s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1385                                    | (val & 0xc7);
1386         cirrus_update_memory_access(s);
1387         break;
1388     default:
1389 #ifdef DEBUG_CIRRUS
1390 	printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1391                s->vga.sr_index, val);
1392 #endif
1393 	break;
1394     }
1395 }
1396 
1397 /***************************************
1398  *
1399  *  I/O access at 0x3c6
1400  *
1401  ***************************************/
1402 
1403 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1404 {
1405     if (++s->cirrus_hidden_dac_lockindex == 5) {
1406         s->cirrus_hidden_dac_lockindex = 0;
1407         return s->cirrus_hidden_dac_data;
1408     }
1409     return 0xff;
1410 }
1411 
1412 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1413 {
1414     if (s->cirrus_hidden_dac_lockindex == 4) {
1415 	s->cirrus_hidden_dac_data = reg_value;
1416 #if defined(DEBUG_CIRRUS)
1417 	printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1418 #endif
1419     }
1420     s->cirrus_hidden_dac_lockindex = 0;
1421 }
1422 
1423 /***************************************
1424  *
1425  *  I/O access at 0x3c9
1426  *
1427  ***************************************/
1428 
1429 static int cirrus_vga_read_palette(CirrusVGAState * s)
1430 {
1431     int val;
1432 
1433     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1434         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1435                                        s->vga.dac_sub_index];
1436     } else {
1437         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1438     }
1439     if (++s->vga.dac_sub_index == 3) {
1440 	s->vga.dac_sub_index = 0;
1441 	s->vga.dac_read_index++;
1442     }
1443     return val;
1444 }
1445 
1446 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1447 {
1448     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1449     if (++s->vga.dac_sub_index == 3) {
1450         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1451             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1452                    s->vga.dac_cache, 3);
1453         } else {
1454             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1455         }
1456         /* XXX update cursor */
1457 	s->vga.dac_sub_index = 0;
1458 	s->vga.dac_write_index++;
1459     }
1460 }
1461 
1462 /***************************************
1463  *
1464  *  I/O access between 0x3ce-0x3cf
1465  *
1466  ***************************************/
1467 
1468 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1469 {
1470     switch (reg_index) {
1471     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1472         return s->cirrus_shadow_gr0;
1473     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1474         return s->cirrus_shadow_gr1;
1475     case 0x02:			// Standard VGA
1476     case 0x03:			// Standard VGA
1477     case 0x04:			// Standard VGA
1478     case 0x06:			// Standard VGA
1479     case 0x07:			// Standard VGA
1480     case 0x08:			// Standard VGA
1481         return s->vga.gr[s->vga.gr_index];
1482     case 0x05:			// Standard VGA, Cirrus extended mode
1483     default:
1484 	break;
1485     }
1486 
1487     if (reg_index < 0x3a) {
1488 	return s->vga.gr[reg_index];
1489     } else {
1490 #ifdef DEBUG_CIRRUS
1491 	printf("cirrus: inport gr_index %02x\n", reg_index);
1492 #endif
1493 	return 0xff;
1494     }
1495 }
1496 
1497 static void
1498 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1499 {
1500 #if defined(DEBUG_BITBLT) && 0
1501     printf("gr%02x: %02x\n", reg_index, reg_value);
1502 #endif
1503     switch (reg_index) {
1504     case 0x00:			// Standard VGA, BGCOLOR 0x000000ff
1505 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1506 	s->cirrus_shadow_gr0 = reg_value;
1507 	break;
1508     case 0x01:			// Standard VGA, FGCOLOR 0x000000ff
1509 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1510 	s->cirrus_shadow_gr1 = reg_value;
1511 	break;
1512     case 0x02:			// Standard VGA
1513     case 0x03:			// Standard VGA
1514     case 0x04:			// Standard VGA
1515     case 0x06:			// Standard VGA
1516     case 0x07:			// Standard VGA
1517     case 0x08:			// Standard VGA
1518 	s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1519         break;
1520     case 0x05:			// Standard VGA, Cirrus extended mode
1521 	s->vga.gr[reg_index] = reg_value & 0x7f;
1522         cirrus_update_memory_access(s);
1523 	break;
1524     case 0x09:			// bank offset #0
1525     case 0x0A:			// bank offset #1
1526 	s->vga.gr[reg_index] = reg_value;
1527 	cirrus_update_bank_ptr(s, 0);
1528 	cirrus_update_bank_ptr(s, 1);
1529         cirrus_update_memory_access(s);
1530         break;
1531     case 0x0B:
1532 	s->vga.gr[reg_index] = reg_value;
1533 	cirrus_update_bank_ptr(s, 0);
1534 	cirrus_update_bank_ptr(s, 1);
1535         cirrus_update_memory_access(s);
1536 	break;
1537     case 0x10:			// BGCOLOR 0x0000ff00
1538     case 0x11:			// FGCOLOR 0x0000ff00
1539     case 0x12:			// BGCOLOR 0x00ff0000
1540     case 0x13:			// FGCOLOR 0x00ff0000
1541     case 0x14:			// BGCOLOR 0xff000000
1542     case 0x15:			// FGCOLOR 0xff000000
1543     case 0x20:			// BLT WIDTH 0x0000ff
1544     case 0x22:			// BLT HEIGHT 0x0000ff
1545     case 0x24:			// BLT DEST PITCH 0x0000ff
1546     case 0x26:			// BLT SRC PITCH 0x0000ff
1547     case 0x28:			// BLT DEST ADDR 0x0000ff
1548     case 0x29:			// BLT DEST ADDR 0x00ff00
1549     case 0x2c:			// BLT SRC ADDR 0x0000ff
1550     case 0x2d:			// BLT SRC ADDR 0x00ff00
1551     case 0x2f:                  // BLT WRITEMASK
1552     case 0x30:			// BLT MODE
1553     case 0x32:			// RASTER OP
1554     case 0x33:			// BLT MODEEXT
1555     case 0x34:			// BLT TRANSPARENT COLOR 0x00ff
1556     case 0x35:			// BLT TRANSPARENT COLOR 0xff00
1557     case 0x38:			// BLT TRANSPARENT COLOR MASK 0x00ff
1558     case 0x39:			// BLT TRANSPARENT COLOR MASK 0xff00
1559 	s->vga.gr[reg_index] = reg_value;
1560 	break;
1561     case 0x21:			// BLT WIDTH 0x001f00
1562     case 0x23:			// BLT HEIGHT 0x001f00
1563     case 0x25:			// BLT DEST PITCH 0x001f00
1564     case 0x27:			// BLT SRC PITCH 0x001f00
1565 	s->vga.gr[reg_index] = reg_value & 0x1f;
1566 	break;
1567     case 0x2a:			// BLT DEST ADDR 0x3f0000
1568 	s->vga.gr[reg_index] = reg_value & 0x3f;
1569         /* if auto start mode, starts bit blt now */
1570         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1571             cirrus_bitblt_start(s);
1572         }
1573 	break;
1574     case 0x2e:			// BLT SRC ADDR 0x3f0000
1575 	s->vga.gr[reg_index] = reg_value & 0x3f;
1576 	break;
1577     case 0x31:			// BLT STATUS/START
1578 	cirrus_write_bitblt(s, reg_value);
1579 	break;
1580     default:
1581 #ifdef DEBUG_CIRRUS
1582 	printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1583 	       reg_value);
1584 #endif
1585 	break;
1586     }
1587 }
1588 
1589 /***************************************
1590  *
1591  *  I/O access between 0x3d4-0x3d5
1592  *
1593  ***************************************/
1594 
1595 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1596 {
1597     switch (reg_index) {
1598     case 0x00:			// Standard VGA
1599     case 0x01:			// Standard VGA
1600     case 0x02:			// Standard VGA
1601     case 0x03:			// Standard VGA
1602     case 0x04:			// Standard VGA
1603     case 0x05:			// Standard VGA
1604     case 0x06:			// Standard VGA
1605     case 0x07:			// Standard VGA
1606     case 0x08:			// Standard VGA
1607     case 0x09:			// Standard VGA
1608     case 0x0a:			// Standard VGA
1609     case 0x0b:			// Standard VGA
1610     case 0x0c:			// Standard VGA
1611     case 0x0d:			// Standard VGA
1612     case 0x0e:			// Standard VGA
1613     case 0x0f:			// Standard VGA
1614     case 0x10:			// Standard VGA
1615     case 0x11:			// Standard VGA
1616     case 0x12:			// Standard VGA
1617     case 0x13:			// Standard VGA
1618     case 0x14:			// Standard VGA
1619     case 0x15:			// Standard VGA
1620     case 0x16:			// Standard VGA
1621     case 0x17:			// Standard VGA
1622     case 0x18:			// Standard VGA
1623 	return s->vga.cr[s->vga.cr_index];
1624     case 0x24:			// Attribute Controller Toggle Readback (R)
1625         return (s->vga.ar_flip_flop << 7);
1626     case 0x19:			// Interlace End
1627     case 0x1a:			// Miscellaneous Control
1628     case 0x1b:			// Extended Display Control
1629     case 0x1c:			// Sync Adjust and Genlock
1630     case 0x1d:			// Overlay Extended Control
1631     case 0x22:			// Graphics Data Latches Readback (R)
1632     case 0x25:			// Part Status
1633     case 0x27:			// Part ID (R)
1634 	return s->vga.cr[s->vga.cr_index];
1635     case 0x26:			// Attribute Controller Index Readback (R)
1636 	return s->vga.ar_index & 0x3f;
1637 	break;
1638     default:
1639 #ifdef DEBUG_CIRRUS
1640 	printf("cirrus: inport cr_index %02x\n", reg_index);
1641 #endif
1642 	return 0xff;
1643     }
1644 }
1645 
1646 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1647 {
1648     switch (s->vga.cr_index) {
1649     case 0x00:			// Standard VGA
1650     case 0x01:			// Standard VGA
1651     case 0x02:			// Standard VGA
1652     case 0x03:			// Standard VGA
1653     case 0x04:			// Standard VGA
1654     case 0x05:			// Standard VGA
1655     case 0x06:			// Standard VGA
1656     case 0x07:			// Standard VGA
1657     case 0x08:			// Standard VGA
1658     case 0x09:			// Standard VGA
1659     case 0x0a:			// Standard VGA
1660     case 0x0b:			// Standard VGA
1661     case 0x0c:			// Standard VGA
1662     case 0x0d:			// Standard VGA
1663     case 0x0e:			// Standard VGA
1664     case 0x0f:			// Standard VGA
1665     case 0x10:			// Standard VGA
1666     case 0x11:			// Standard VGA
1667     case 0x12:			// Standard VGA
1668     case 0x13:			// Standard VGA
1669     case 0x14:			// Standard VGA
1670     case 0x15:			// Standard VGA
1671     case 0x16:			// Standard VGA
1672     case 0x17:			// Standard VGA
1673     case 0x18:			// Standard VGA
1674 	/* handle CR0-7 protection */
1675 	if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1676 	    /* can always write bit 4 of CR7 */
1677 	    if (s->vga.cr_index == 7)
1678 		s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1679 	    return;
1680 	}
1681 	s->vga.cr[s->vga.cr_index] = reg_value;
1682 	switch(s->vga.cr_index) {
1683 	case 0x00:
1684 	case 0x04:
1685 	case 0x05:
1686 	case 0x06:
1687 	case 0x07:
1688 	case 0x11:
1689 	case 0x17:
1690 	    s->vga.update_retrace_info(&s->vga);
1691 	    break;
1692 	}
1693         break;
1694     case 0x19:			// Interlace End
1695     case 0x1a:			// Miscellaneous Control
1696     case 0x1b:			// Extended Display Control
1697     case 0x1c:			// Sync Adjust and Genlock
1698     case 0x1d:			// Overlay Extended Control
1699 	s->vga.cr[s->vga.cr_index] = reg_value;
1700 #ifdef DEBUG_CIRRUS
1701 	printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1702 	       s->vga.cr_index, reg_value);
1703 #endif
1704 	break;
1705     case 0x22:			// Graphics Data Latches Readback (R)
1706     case 0x24:			// Attribute Controller Toggle Readback (R)
1707     case 0x26:			// Attribute Controller Index Readback (R)
1708     case 0x27:			// Part ID (R)
1709 	break;
1710     case 0x25:			// Part Status
1711     default:
1712 #ifdef DEBUG_CIRRUS
1713 	printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1714                s->vga.cr_index, reg_value);
1715 #endif
1716 	break;
1717     }
1718 }
1719 
1720 /***************************************
1721  *
1722  *  memory-mapped I/O (bitblt)
1723  *
1724  ***************************************/
1725 
1726 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1727 {
1728     int value = 0xff;
1729 
1730     switch (address) {
1731     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1732 	value = cirrus_vga_read_gr(s, 0x00);
1733 	break;
1734     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1735 	value = cirrus_vga_read_gr(s, 0x10);
1736 	break;
1737     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1738 	value = cirrus_vga_read_gr(s, 0x12);
1739 	break;
1740     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1741 	value = cirrus_vga_read_gr(s, 0x14);
1742 	break;
1743     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1744 	value = cirrus_vga_read_gr(s, 0x01);
1745 	break;
1746     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1747 	value = cirrus_vga_read_gr(s, 0x11);
1748 	break;
1749     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1750 	value = cirrus_vga_read_gr(s, 0x13);
1751 	break;
1752     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1753 	value = cirrus_vga_read_gr(s, 0x15);
1754 	break;
1755     case (CIRRUS_MMIO_BLTWIDTH + 0):
1756 	value = cirrus_vga_read_gr(s, 0x20);
1757 	break;
1758     case (CIRRUS_MMIO_BLTWIDTH + 1):
1759 	value = cirrus_vga_read_gr(s, 0x21);
1760 	break;
1761     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1762 	value = cirrus_vga_read_gr(s, 0x22);
1763 	break;
1764     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1765 	value = cirrus_vga_read_gr(s, 0x23);
1766 	break;
1767     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1768 	value = cirrus_vga_read_gr(s, 0x24);
1769 	break;
1770     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1771 	value = cirrus_vga_read_gr(s, 0x25);
1772 	break;
1773     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1774 	value = cirrus_vga_read_gr(s, 0x26);
1775 	break;
1776     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1777 	value = cirrus_vga_read_gr(s, 0x27);
1778 	break;
1779     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1780 	value = cirrus_vga_read_gr(s, 0x28);
1781 	break;
1782     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1783 	value = cirrus_vga_read_gr(s, 0x29);
1784 	break;
1785     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1786 	value = cirrus_vga_read_gr(s, 0x2a);
1787 	break;
1788     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1789 	value = cirrus_vga_read_gr(s, 0x2c);
1790 	break;
1791     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1792 	value = cirrus_vga_read_gr(s, 0x2d);
1793 	break;
1794     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1795 	value = cirrus_vga_read_gr(s, 0x2e);
1796 	break;
1797     case CIRRUS_MMIO_BLTWRITEMASK:
1798 	value = cirrus_vga_read_gr(s, 0x2f);
1799 	break;
1800     case CIRRUS_MMIO_BLTMODE:
1801 	value = cirrus_vga_read_gr(s, 0x30);
1802 	break;
1803     case CIRRUS_MMIO_BLTROP:
1804 	value = cirrus_vga_read_gr(s, 0x32);
1805 	break;
1806     case CIRRUS_MMIO_BLTMODEEXT:
1807 	value = cirrus_vga_read_gr(s, 0x33);
1808 	break;
1809     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1810 	value = cirrus_vga_read_gr(s, 0x34);
1811 	break;
1812     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1813 	value = cirrus_vga_read_gr(s, 0x35);
1814 	break;
1815     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1816 	value = cirrus_vga_read_gr(s, 0x38);
1817 	break;
1818     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1819 	value = cirrus_vga_read_gr(s, 0x39);
1820 	break;
1821     case CIRRUS_MMIO_BLTSTATUS:
1822 	value = cirrus_vga_read_gr(s, 0x31);
1823 	break;
1824     default:
1825 #ifdef DEBUG_CIRRUS
1826 	printf("cirrus: mmio read - address 0x%04x\n", address);
1827 #endif
1828 	break;
1829     }
1830 
1831     return (uint8_t) value;
1832 }
1833 
1834 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1835 				  uint8_t value)
1836 {
1837     switch (address) {
1838     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1839 	cirrus_vga_write_gr(s, 0x00, value);
1840 	break;
1841     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1842 	cirrus_vga_write_gr(s, 0x10, value);
1843 	break;
1844     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1845 	cirrus_vga_write_gr(s, 0x12, value);
1846 	break;
1847     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1848 	cirrus_vga_write_gr(s, 0x14, value);
1849 	break;
1850     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1851 	cirrus_vga_write_gr(s, 0x01, value);
1852 	break;
1853     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1854 	cirrus_vga_write_gr(s, 0x11, value);
1855 	break;
1856     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1857 	cirrus_vga_write_gr(s, 0x13, value);
1858 	break;
1859     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1860 	cirrus_vga_write_gr(s, 0x15, value);
1861 	break;
1862     case (CIRRUS_MMIO_BLTWIDTH + 0):
1863 	cirrus_vga_write_gr(s, 0x20, value);
1864 	break;
1865     case (CIRRUS_MMIO_BLTWIDTH + 1):
1866 	cirrus_vga_write_gr(s, 0x21, value);
1867 	break;
1868     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1869 	cirrus_vga_write_gr(s, 0x22, value);
1870 	break;
1871     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1872 	cirrus_vga_write_gr(s, 0x23, value);
1873 	break;
1874     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1875 	cirrus_vga_write_gr(s, 0x24, value);
1876 	break;
1877     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1878 	cirrus_vga_write_gr(s, 0x25, value);
1879 	break;
1880     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1881 	cirrus_vga_write_gr(s, 0x26, value);
1882 	break;
1883     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1884 	cirrus_vga_write_gr(s, 0x27, value);
1885 	break;
1886     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1887 	cirrus_vga_write_gr(s, 0x28, value);
1888 	break;
1889     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1890 	cirrus_vga_write_gr(s, 0x29, value);
1891 	break;
1892     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1893 	cirrus_vga_write_gr(s, 0x2a, value);
1894 	break;
1895     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1896 	/* ignored */
1897 	break;
1898     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1899 	cirrus_vga_write_gr(s, 0x2c, value);
1900 	break;
1901     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1902 	cirrus_vga_write_gr(s, 0x2d, value);
1903 	break;
1904     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1905 	cirrus_vga_write_gr(s, 0x2e, value);
1906 	break;
1907     case CIRRUS_MMIO_BLTWRITEMASK:
1908 	cirrus_vga_write_gr(s, 0x2f, value);
1909 	break;
1910     case CIRRUS_MMIO_BLTMODE:
1911 	cirrus_vga_write_gr(s, 0x30, value);
1912 	break;
1913     case CIRRUS_MMIO_BLTROP:
1914 	cirrus_vga_write_gr(s, 0x32, value);
1915 	break;
1916     case CIRRUS_MMIO_BLTMODEEXT:
1917 	cirrus_vga_write_gr(s, 0x33, value);
1918 	break;
1919     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1920 	cirrus_vga_write_gr(s, 0x34, value);
1921 	break;
1922     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1923 	cirrus_vga_write_gr(s, 0x35, value);
1924 	break;
1925     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1926 	cirrus_vga_write_gr(s, 0x38, value);
1927 	break;
1928     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1929 	cirrus_vga_write_gr(s, 0x39, value);
1930 	break;
1931     case CIRRUS_MMIO_BLTSTATUS:
1932 	cirrus_vga_write_gr(s, 0x31, value);
1933 	break;
1934     default:
1935 #ifdef DEBUG_CIRRUS
1936 	printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1937 	       address, value);
1938 #endif
1939 	break;
1940     }
1941 }
1942 
1943 /***************************************
1944  *
1945  *  write mode 4/5
1946  *
1947  ***************************************/
1948 
1949 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1950 					     unsigned mode,
1951 					     unsigned offset,
1952 					     uint32_t mem_value)
1953 {
1954     int x;
1955     unsigned val = mem_value;
1956     uint8_t *dst;
1957 
1958     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1959     for (x = 0; x < 8; x++) {
1960 	if (val & 0x80) {
1961 	    *dst = s->cirrus_shadow_gr1;
1962 	} else if (mode == 5) {
1963 	    *dst = s->cirrus_shadow_gr0;
1964 	}
1965 	val <<= 1;
1966 	dst++;
1967     }
1968     memory_region_set_dirty(&s->vga.vram, offset, 8);
1969 }
1970 
1971 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1972 					      unsigned mode,
1973 					      unsigned offset,
1974 					      uint32_t mem_value)
1975 {
1976     int x;
1977     unsigned val = mem_value;
1978     uint8_t *dst;
1979 
1980     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1981     for (x = 0; x < 8; x++) {
1982 	if (val & 0x80) {
1983 	    *dst = s->cirrus_shadow_gr1;
1984 	    *(dst + 1) = s->vga.gr[0x11];
1985 	} else if (mode == 5) {
1986 	    *dst = s->cirrus_shadow_gr0;
1987 	    *(dst + 1) = s->vga.gr[0x10];
1988 	}
1989 	val <<= 1;
1990 	dst += 2;
1991     }
1992     memory_region_set_dirty(&s->vga.vram, offset, 16);
1993 }
1994 
1995 /***************************************
1996  *
1997  *  memory access between 0xa0000-0xbffff
1998  *
1999  ***************************************/
2000 
2001 static uint64_t cirrus_vga_mem_read(void *opaque,
2002                                     hwaddr addr,
2003                                     uint32_t size)
2004 {
2005     CirrusVGAState *s = opaque;
2006     unsigned bank_index;
2007     unsigned bank_offset;
2008     uint32_t val;
2009 
2010     if ((s->vga.sr[0x07] & 0x01) == 0) {
2011         return vga_mem_readb(&s->vga, addr);
2012     }
2013 
2014     if (addr < 0x10000) {
2015 	/* XXX handle bitblt */
2016 	/* video memory */
2017 	bank_index = addr >> 15;
2018 	bank_offset = addr & 0x7fff;
2019 	if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2020 	    bank_offset += s->cirrus_bank_base[bank_index];
2021 	    if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2022 		bank_offset <<= 4;
2023 	    } else if (s->vga.gr[0x0B] & 0x02) {
2024 		bank_offset <<= 3;
2025 	    }
2026 	    bank_offset &= s->cirrus_addr_mask;
2027 	    val = *(s->vga.vram_ptr + bank_offset);
2028 	} else
2029 	    val = 0xff;
2030     } else if (addr >= 0x18000 && addr < 0x18100) {
2031 	/* memory-mapped I/O */
2032 	val = 0xff;
2033 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2034 	    val = cirrus_mmio_blt_read(s, addr & 0xff);
2035 	}
2036     } else {
2037 	val = 0xff;
2038 #ifdef DEBUG_CIRRUS
2039 	printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2040 #endif
2041     }
2042     return val;
2043 }
2044 
2045 static void cirrus_vga_mem_write(void *opaque,
2046                                  hwaddr addr,
2047                                  uint64_t mem_value,
2048                                  uint32_t size)
2049 {
2050     CirrusVGAState *s = opaque;
2051     unsigned bank_index;
2052     unsigned bank_offset;
2053     unsigned mode;
2054 
2055     if ((s->vga.sr[0x07] & 0x01) == 0) {
2056         vga_mem_writeb(&s->vga, addr, mem_value);
2057         return;
2058     }
2059 
2060     if (addr < 0x10000) {
2061 	if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2062 	    /* bitblt */
2063 	    *s->cirrus_srcptr++ = (uint8_t) mem_value;
2064 	    if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2065 		cirrus_bitblt_cputovideo_next(s);
2066 	    }
2067 	} else {
2068 	    /* video memory */
2069 	    bank_index = addr >> 15;
2070 	    bank_offset = addr & 0x7fff;
2071 	    if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2072 		bank_offset += s->cirrus_bank_base[bank_index];
2073 		if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2074 		    bank_offset <<= 4;
2075 		} else if (s->vga.gr[0x0B] & 0x02) {
2076 		    bank_offset <<= 3;
2077 		}
2078 		bank_offset &= s->cirrus_addr_mask;
2079 		mode = s->vga.gr[0x05] & 0x7;
2080 		if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2081 		    *(s->vga.vram_ptr + bank_offset) = mem_value;
2082                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2083                                             sizeof(mem_value));
2084 		} else {
2085 		    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2086 			cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2087 							 bank_offset,
2088 							 mem_value);
2089 		    } else {
2090 			cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2091 							  bank_offset,
2092 							  mem_value);
2093 		    }
2094 		}
2095 	    }
2096 	}
2097     } else if (addr >= 0x18000 && addr < 0x18100) {
2098 	/* memory-mapped I/O */
2099 	if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2100 	    cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2101 	}
2102     } else {
2103 #ifdef DEBUG_CIRRUS
2104         printf("cirrus: mem_writeb " TARGET_FMT_plx " value 0x%02" PRIu64 "\n", addr,
2105                mem_value);
2106 #endif
2107     }
2108 }
2109 
2110 static const MemoryRegionOps cirrus_vga_mem_ops = {
2111     .read = cirrus_vga_mem_read,
2112     .write = cirrus_vga_mem_write,
2113     .endianness = DEVICE_LITTLE_ENDIAN,
2114     .impl = {
2115         .min_access_size = 1,
2116         .max_access_size = 1,
2117     },
2118 };
2119 
2120 /***************************************
2121  *
2122  *  hardware cursor
2123  *
2124  ***************************************/
2125 
2126 static inline void invalidate_cursor1(CirrusVGAState *s)
2127 {
2128     if (s->last_hw_cursor_size) {
2129         vga_invalidate_scanlines(&s->vga,
2130                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2131                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2132     }
2133 }
2134 
2135 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2136 {
2137     const uint8_t *src;
2138     uint32_t content;
2139     int y, y_min, y_max;
2140 
2141     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2142     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2143         src += (s->vga.sr[0x13] & 0x3c) * 256;
2144         y_min = 64;
2145         y_max = -1;
2146         for(y = 0; y < 64; y++) {
2147             content = ((uint32_t *)src)[0] |
2148                 ((uint32_t *)src)[1] |
2149                 ((uint32_t *)src)[2] |
2150                 ((uint32_t *)src)[3];
2151             if (content) {
2152                 if (y < y_min)
2153                     y_min = y;
2154                 if (y > y_max)
2155                     y_max = y;
2156             }
2157             src += 16;
2158         }
2159     } else {
2160         src += (s->vga.sr[0x13] & 0x3f) * 256;
2161         y_min = 32;
2162         y_max = -1;
2163         for(y = 0; y < 32; y++) {
2164             content = ((uint32_t *)src)[0] |
2165                 ((uint32_t *)(src + 128))[0];
2166             if (content) {
2167                 if (y < y_min)
2168                     y_min = y;
2169                 if (y > y_max)
2170                     y_max = y;
2171             }
2172             src += 4;
2173         }
2174     }
2175     if (y_min > y_max) {
2176         s->last_hw_cursor_y_start = 0;
2177         s->last_hw_cursor_y_end = 0;
2178     } else {
2179         s->last_hw_cursor_y_start = y_min;
2180         s->last_hw_cursor_y_end = y_max + 1;
2181     }
2182 }
2183 
2184 /* NOTE: we do not currently handle the cursor bitmap change, so we
2185    update the cursor only if it moves. */
2186 static void cirrus_cursor_invalidate(VGACommonState *s1)
2187 {
2188     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2189     int size;
2190 
2191     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2192         size = 0;
2193     } else {
2194         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2195             size = 64;
2196         else
2197             size = 32;
2198     }
2199     /* invalidate last cursor and new cursor if any change */
2200     if (s->last_hw_cursor_size != size ||
2201         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2202         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2203 
2204         invalidate_cursor1(s);
2205 
2206         s->last_hw_cursor_size = size;
2207         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2208         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2209         /* compute the real cursor min and max y */
2210         cirrus_cursor_compute_yrange(s);
2211         invalidate_cursor1(s);
2212     }
2213 }
2214 
2215 static void vga_draw_cursor_line(uint8_t *d1,
2216                                  const uint8_t *src1,
2217                                  int poffset, int w,
2218                                  unsigned int color0,
2219                                  unsigned int color1,
2220                                  unsigned int color_xor)
2221 {
2222     const uint8_t *plane0, *plane1;
2223     int x, b0, b1;
2224     uint8_t *d;
2225 
2226     d = d1;
2227     plane0 = src1;
2228     plane1 = src1 + poffset;
2229     for (x = 0; x < w; x++) {
2230         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2231         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2232         switch (b0 | (b1 << 1)) {
2233         case 0:
2234             break;
2235         case 1:
2236             ((uint32_t *)d)[0] ^= color_xor;
2237             break;
2238         case 2:
2239             ((uint32_t *)d)[0] = color0;
2240             break;
2241         case 3:
2242             ((uint32_t *)d)[0] = color1;
2243             break;
2244         }
2245         d += 4;
2246     }
2247 }
2248 
2249 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2250 {
2251     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2252     int w, h, x1, x2, poffset;
2253     unsigned int color0, color1;
2254     const uint8_t *palette, *src;
2255     uint32_t content;
2256 
2257     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2258         return;
2259     /* fast test to see if the cursor intersects with the scan line */
2260     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2261         h = 64;
2262     } else {
2263         h = 32;
2264     }
2265     if (scr_y < s->vga.hw_cursor_y ||
2266         scr_y >= (s->vga.hw_cursor_y + h)) {
2267         return;
2268     }
2269 
2270     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2271     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2272         src += (s->vga.sr[0x13] & 0x3c) * 256;
2273         src += (scr_y - s->vga.hw_cursor_y) * 16;
2274         poffset = 8;
2275         content = ((uint32_t *)src)[0] |
2276             ((uint32_t *)src)[1] |
2277             ((uint32_t *)src)[2] |
2278             ((uint32_t *)src)[3];
2279     } else {
2280         src += (s->vga.sr[0x13] & 0x3f) * 256;
2281         src += (scr_y - s->vga.hw_cursor_y) * 4;
2282 
2283 
2284         poffset = 128;
2285         content = ((uint32_t *)src)[0] |
2286             ((uint32_t *)(src + 128))[0];
2287     }
2288     /* if nothing to draw, no need to continue */
2289     if (!content)
2290         return;
2291     w = h;
2292 
2293     x1 = s->vga.hw_cursor_x;
2294     if (x1 >= s->vga.last_scr_width)
2295         return;
2296     x2 = s->vga.hw_cursor_x + w;
2297     if (x2 > s->vga.last_scr_width)
2298         x2 = s->vga.last_scr_width;
2299     w = x2 - x1;
2300     palette = s->cirrus_hidden_palette;
2301     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2302                             c6_to_8(palette[0x0 * 3 + 1]),
2303                             c6_to_8(palette[0x0 * 3 + 2]));
2304     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2305                             c6_to_8(palette[0xf * 3 + 1]),
2306                             c6_to_8(palette[0xf * 3 + 2]));
2307     d1 += x1 * 4;
2308     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2309 }
2310 
2311 /***************************************
2312  *
2313  *  LFB memory access
2314  *
2315  ***************************************/
2316 
2317 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2318                                    unsigned size)
2319 {
2320     CirrusVGAState *s = opaque;
2321     uint32_t ret;
2322 
2323     addr &= s->cirrus_addr_mask;
2324 
2325     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2326         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2327 	/* memory-mapped I/O */
2328 	ret = cirrus_mmio_blt_read(s, addr & 0xff);
2329     } else if (0) {
2330 	/* XXX handle bitblt */
2331 	ret = 0xff;
2332     } else {
2333 	/* video memory */
2334 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2335 	    addr <<= 4;
2336 	} else if (s->vga.gr[0x0B] & 0x02) {
2337 	    addr <<= 3;
2338 	}
2339 	addr &= s->cirrus_addr_mask;
2340 	ret = *(s->vga.vram_ptr + addr);
2341     }
2342 
2343     return ret;
2344 }
2345 
2346 static void cirrus_linear_write(void *opaque, hwaddr addr,
2347                                 uint64_t val, unsigned size)
2348 {
2349     CirrusVGAState *s = opaque;
2350     unsigned mode;
2351 
2352     addr &= s->cirrus_addr_mask;
2353 
2354     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2355         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2356 	/* memory-mapped I/O */
2357 	cirrus_mmio_blt_write(s, addr & 0xff, val);
2358     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2359 	/* bitblt */
2360 	*s->cirrus_srcptr++ = (uint8_t) val;
2361 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2362 	    cirrus_bitblt_cputovideo_next(s);
2363 	}
2364     } else {
2365 	/* video memory */
2366 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2367 	    addr <<= 4;
2368 	} else if (s->vga.gr[0x0B] & 0x02) {
2369 	    addr <<= 3;
2370 	}
2371 	addr &= s->cirrus_addr_mask;
2372 
2373 	mode = s->vga.gr[0x05] & 0x7;
2374 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2375 	    *(s->vga.vram_ptr + addr) = (uint8_t) val;
2376             memory_region_set_dirty(&s->vga.vram, addr, 1);
2377 	} else {
2378 	    if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2379 		cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2380 	    } else {
2381 		cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2382 	    }
2383 	}
2384     }
2385 }
2386 
2387 /***************************************
2388  *
2389  *  system to screen memory access
2390  *
2391  ***************************************/
2392 
2393 
2394 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2395                                           hwaddr addr,
2396                                           unsigned size)
2397 {
2398     CirrusVGAState *s = opaque;
2399     uint32_t ret;
2400 
2401     /* XXX handle bitblt */
2402     (void)s;
2403     ret = 0xff;
2404     return ret;
2405 }
2406 
2407 static void cirrus_linear_bitblt_write(void *opaque,
2408                                        hwaddr addr,
2409                                        uint64_t val,
2410                                        unsigned size)
2411 {
2412     CirrusVGAState *s = opaque;
2413 
2414     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2415 	/* bitblt */
2416 	*s->cirrus_srcptr++ = (uint8_t) val;
2417 	if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2418 	    cirrus_bitblt_cputovideo_next(s);
2419 	}
2420     }
2421 }
2422 
2423 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2424     .read = cirrus_linear_bitblt_read,
2425     .write = cirrus_linear_bitblt_write,
2426     .endianness = DEVICE_LITTLE_ENDIAN,
2427     .impl = {
2428         .min_access_size = 1,
2429         .max_access_size = 1,
2430     },
2431 };
2432 
2433 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2434 {
2435     MemoryRegion *mr = &s->cirrus_bank[bank];
2436     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2437         && !((s->vga.sr[0x07] & 0x01) == 0)
2438         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2439         && !(s->vga.gr[0x0B] & 0x02);
2440 
2441     memory_region_set_enabled(mr, enabled);
2442     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2443 }
2444 
2445 static void map_linear_vram(CirrusVGAState *s)
2446 {
2447     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2448         s->linear_vram = true;
2449         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2450     }
2451     map_linear_vram_bank(s, 0);
2452     map_linear_vram_bank(s, 1);
2453 }
2454 
2455 static void unmap_linear_vram(CirrusVGAState *s)
2456 {
2457     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2458         s->linear_vram = false;
2459         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2460     }
2461     memory_region_set_enabled(&s->cirrus_bank[0], false);
2462     memory_region_set_enabled(&s->cirrus_bank[1], false);
2463 }
2464 
2465 /* Compute the memory access functions */
2466 static void cirrus_update_memory_access(CirrusVGAState *s)
2467 {
2468     unsigned mode;
2469 
2470     memory_region_transaction_begin();
2471     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2472         goto generic_io;
2473     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2474         goto generic_io;
2475     } else {
2476 	if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2477             goto generic_io;
2478 	} else if (s->vga.gr[0x0B] & 0x02) {
2479             goto generic_io;
2480         }
2481 
2482 	mode = s->vga.gr[0x05] & 0x7;
2483 	if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2484             map_linear_vram(s);
2485         } else {
2486         generic_io:
2487             unmap_linear_vram(s);
2488         }
2489     }
2490     memory_region_transaction_commit();
2491 }
2492 
2493 
2494 /* I/O ports */
2495 
2496 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2497                                        unsigned size)
2498 {
2499     CirrusVGAState *c = opaque;
2500     VGACommonState *s = &c->vga;
2501     int val, index;
2502 
2503     addr += 0x3b0;
2504 
2505     if (vga_ioport_invalid(s, addr)) {
2506 	val = 0xff;
2507     } else {
2508 	switch (addr) {
2509 	case 0x3c0:
2510 	    if (s->ar_flip_flop == 0) {
2511 		val = s->ar_index;
2512 	    } else {
2513 		val = 0;
2514 	    }
2515 	    break;
2516 	case 0x3c1:
2517 	    index = s->ar_index & 0x1f;
2518 	    if (index < 21)
2519 		val = s->ar[index];
2520 	    else
2521 		val = 0;
2522 	    break;
2523 	case 0x3c2:
2524 	    val = s->st00;
2525 	    break;
2526 	case 0x3c4:
2527 	    val = s->sr_index;
2528 	    break;
2529 	case 0x3c5:
2530 	    val = cirrus_vga_read_sr(c);
2531             break;
2532 #ifdef DEBUG_VGA_REG
2533 	    printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2534 #endif
2535 	    break;
2536 	case 0x3c6:
2537 	    val = cirrus_read_hidden_dac(c);
2538 	    break;
2539 	case 0x3c7:
2540 	    val = s->dac_state;
2541 	    break;
2542 	case 0x3c8:
2543 	    val = s->dac_write_index;
2544 	    c->cirrus_hidden_dac_lockindex = 0;
2545 	    break;
2546         case 0x3c9:
2547             val = cirrus_vga_read_palette(c);
2548             break;
2549 	case 0x3ca:
2550 	    val = s->fcr;
2551 	    break;
2552 	case 0x3cc:
2553 	    val = s->msr;
2554 	    break;
2555 	case 0x3ce:
2556 	    val = s->gr_index;
2557 	    break;
2558 	case 0x3cf:
2559 	    val = cirrus_vga_read_gr(c, s->gr_index);
2560 #ifdef DEBUG_VGA_REG
2561 	    printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2562 #endif
2563 	    break;
2564 	case 0x3b4:
2565 	case 0x3d4:
2566 	    val = s->cr_index;
2567 	    break;
2568 	case 0x3b5:
2569 	case 0x3d5:
2570             val = cirrus_vga_read_cr(c, s->cr_index);
2571 #ifdef DEBUG_VGA_REG
2572 	    printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2573 #endif
2574 	    break;
2575 	case 0x3ba:
2576 	case 0x3da:
2577 	    /* just toggle to fool polling */
2578 	    val = s->st01 = s->retrace(s);
2579 	    s->ar_flip_flop = 0;
2580 	    break;
2581 	default:
2582 	    val = 0x00;
2583 	    break;
2584 	}
2585     }
2586 #if defined(DEBUG_VGA)
2587     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
2588 #endif
2589     return val;
2590 }
2591 
2592 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2593                                     unsigned size)
2594 {
2595     CirrusVGAState *c = opaque;
2596     VGACommonState *s = &c->vga;
2597     int index;
2598 
2599     addr += 0x3b0;
2600 
2601     /* check port range access depending on color/monochrome mode */
2602     if (vga_ioport_invalid(s, addr)) {
2603 	return;
2604     }
2605 #ifdef DEBUG_VGA
2606     printf("VGA: write addr=0x%04x data=0x%02x\n", addr, val);
2607 #endif
2608 
2609     switch (addr) {
2610     case 0x3c0:
2611 	if (s->ar_flip_flop == 0) {
2612 	    val &= 0x3f;
2613 	    s->ar_index = val;
2614 	} else {
2615 	    index = s->ar_index & 0x1f;
2616 	    switch (index) {
2617 	    case 0x00 ... 0x0f:
2618 		s->ar[index] = val & 0x3f;
2619 		break;
2620 	    case 0x10:
2621 		s->ar[index] = val & ~0x10;
2622 		break;
2623 	    case 0x11:
2624 		s->ar[index] = val;
2625 		break;
2626 	    case 0x12:
2627 		s->ar[index] = val & ~0xc0;
2628 		break;
2629 	    case 0x13:
2630 		s->ar[index] = val & ~0xf0;
2631 		break;
2632 	    case 0x14:
2633 		s->ar[index] = val & ~0xf0;
2634 		break;
2635 	    default:
2636 		break;
2637 	    }
2638 	}
2639 	s->ar_flip_flop ^= 1;
2640 	break;
2641     case 0x3c2:
2642 	s->msr = val & ~0x10;
2643 	s->update_retrace_info(s);
2644 	break;
2645     case 0x3c4:
2646 	s->sr_index = val;
2647 	break;
2648     case 0x3c5:
2649 #ifdef DEBUG_VGA_REG
2650 	printf("vga: write SR%x = 0x%02" PRIu64 "\n", s->sr_index, val);
2651 #endif
2652 	cirrus_vga_write_sr(c, val);
2653         break;
2654     case 0x3c6:
2655 	cirrus_write_hidden_dac(c, val);
2656 	break;
2657     case 0x3c7:
2658 	s->dac_read_index = val;
2659 	s->dac_sub_index = 0;
2660 	s->dac_state = 3;
2661 	break;
2662     case 0x3c8:
2663 	s->dac_write_index = val;
2664 	s->dac_sub_index = 0;
2665 	s->dac_state = 0;
2666 	break;
2667     case 0x3c9:
2668         cirrus_vga_write_palette(c, val);
2669         break;
2670     case 0x3ce:
2671 	s->gr_index = val;
2672 	break;
2673     case 0x3cf:
2674 #ifdef DEBUG_VGA_REG
2675 	printf("vga: write GR%x = 0x%02" PRIu64 "\n", s->gr_index, val);
2676 #endif
2677 	cirrus_vga_write_gr(c, s->gr_index, val);
2678 	break;
2679     case 0x3b4:
2680     case 0x3d4:
2681 	s->cr_index = val;
2682 	break;
2683     case 0x3b5:
2684     case 0x3d5:
2685 #ifdef DEBUG_VGA_REG
2686 	printf("vga: write CR%x = 0x%02"PRIu64"\n", s->cr_index, val);
2687 #endif
2688 	cirrus_vga_write_cr(c, val);
2689 	break;
2690     case 0x3ba:
2691     case 0x3da:
2692 	s->fcr = val & 0x10;
2693 	break;
2694     }
2695 }
2696 
2697 /***************************************
2698  *
2699  *  memory-mapped I/O access
2700  *
2701  ***************************************/
2702 
2703 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2704                                  unsigned size)
2705 {
2706     CirrusVGAState *s = opaque;
2707 
2708     if (addr >= 0x100) {
2709         return cirrus_mmio_blt_read(s, addr - 0x100);
2710     } else {
2711         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2712     }
2713 }
2714 
2715 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2716                               uint64_t val, unsigned size)
2717 {
2718     CirrusVGAState *s = opaque;
2719 
2720     if (addr >= 0x100) {
2721 	cirrus_mmio_blt_write(s, addr - 0x100, val);
2722     } else {
2723         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2724     }
2725 }
2726 
2727 static const MemoryRegionOps cirrus_mmio_io_ops = {
2728     .read = cirrus_mmio_read,
2729     .write = cirrus_mmio_write,
2730     .endianness = DEVICE_LITTLE_ENDIAN,
2731     .impl = {
2732         .min_access_size = 1,
2733         .max_access_size = 1,
2734     },
2735 };
2736 
2737 /* load/save state */
2738 
2739 static int cirrus_post_load(void *opaque, int version_id)
2740 {
2741     CirrusVGAState *s = opaque;
2742 
2743     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2744     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2745 
2746     cirrus_update_memory_access(s);
2747     /* force refresh */
2748     s->vga.graphic_mode = -1;
2749     cirrus_update_bank_ptr(s, 0);
2750     cirrus_update_bank_ptr(s, 1);
2751     return 0;
2752 }
2753 
2754 static const VMStateDescription vmstate_cirrus_vga = {
2755     .name = "cirrus_vga",
2756     .version_id = 2,
2757     .minimum_version_id = 1,
2758     .post_load = cirrus_post_load,
2759     .fields = (VMStateField[]) {
2760         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2761         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2762         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2763         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2764         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2765         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2766         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2767         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2768         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2769         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2770         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2771         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2772         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2773         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2774         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2775         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2776         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2777         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2778         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2779         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2780         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2781         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2782         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2783         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2784         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2785         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2786         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2787         /* XXX: we do not save the bitblt state - we assume we do not save
2788            the state when the blitter is active */
2789         VMSTATE_END_OF_LIST()
2790     }
2791 };
2792 
2793 static const VMStateDescription vmstate_pci_cirrus_vga = {
2794     .name = "cirrus_vga",
2795     .version_id = 2,
2796     .minimum_version_id = 2,
2797     .fields = (VMStateField[]) {
2798         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2799         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2800                        vmstate_cirrus_vga, CirrusVGAState),
2801         VMSTATE_END_OF_LIST()
2802     }
2803 };
2804 
2805 /***************************************
2806  *
2807  *  initialize
2808  *
2809  ***************************************/
2810 
2811 static void cirrus_reset(void *opaque)
2812 {
2813     CirrusVGAState *s = opaque;
2814 
2815     vga_common_reset(&s->vga);
2816     unmap_linear_vram(s);
2817     s->vga.sr[0x06] = 0x0f;
2818     if (s->device_id == CIRRUS_ID_CLGD5446) {
2819         /* 4MB 64 bit memory config, always PCI */
2820         s->vga.sr[0x1F] = 0x2d;		// MemClock
2821         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2822         s->vga.sr[0x0f] = 0x98;
2823         s->vga.sr[0x17] = 0x20;
2824         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2825     } else {
2826         s->vga.sr[0x1F] = 0x22;		// MemClock
2827         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2828         s->vga.sr[0x17] = s->bustype;
2829         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2830     }
2831     s->vga.cr[0x27] = s->device_id;
2832 
2833     s->cirrus_hidden_dac_lockindex = 5;
2834     s->cirrus_hidden_dac_data = 0;
2835 }
2836 
2837 static const MemoryRegionOps cirrus_linear_io_ops = {
2838     .read = cirrus_linear_read,
2839     .write = cirrus_linear_write,
2840     .endianness = DEVICE_LITTLE_ENDIAN,
2841     .impl = {
2842         .min_access_size = 1,
2843         .max_access_size = 1,
2844     },
2845 };
2846 
2847 static const MemoryRegionOps cirrus_vga_io_ops = {
2848     .read = cirrus_vga_ioport_read,
2849     .write = cirrus_vga_ioport_write,
2850     .endianness = DEVICE_LITTLE_ENDIAN,
2851     .impl = {
2852         .min_access_size = 1,
2853         .max_access_size = 1,
2854     },
2855 };
2856 
2857 static void cirrus_init_common(CirrusVGAState *s, Object *owner,
2858                                int device_id, int is_pci,
2859                                MemoryRegion *system_memory,
2860                                MemoryRegion *system_io)
2861 {
2862     int i;
2863     static int inited;
2864 
2865     if (!inited) {
2866         inited = 1;
2867         for(i = 0;i < 256; i++)
2868             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2869         rop_to_index[CIRRUS_ROP_0] = 0;
2870         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2871         rop_to_index[CIRRUS_ROP_NOP] = 2;
2872         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2873         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2874         rop_to_index[CIRRUS_ROP_SRC] = 5;
2875         rop_to_index[CIRRUS_ROP_1] = 6;
2876         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2877         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2878         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2879         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2880         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2881         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2882         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2883         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2884         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2885         s->device_id = device_id;
2886         if (is_pci)
2887             s->bustype = CIRRUS_BUSTYPE_PCI;
2888         else
2889             s->bustype = CIRRUS_BUSTYPE_ISA;
2890     }
2891 
2892     /* Register ioport 0x3b0 - 0x3df */
2893     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2894                           "cirrus-io", 0x30);
2895     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2896     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2897 
2898     memory_region_init(&s->low_mem_container, owner,
2899                        "cirrus-lowmem-container",
2900                        0x20000);
2901 
2902     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2903                           "cirrus-low-memory", 0x20000);
2904     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2905     for (i = 0; i < 2; ++i) {
2906         static const char *names[] = { "vga.bank0", "vga.bank1" };
2907         MemoryRegion *bank = &s->cirrus_bank[i];
2908         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2909                                  0, 0x8000);
2910         memory_region_set_enabled(bank, false);
2911         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2912                                             bank, 1);
2913     }
2914     memory_region_add_subregion_overlap(system_memory,
2915                                         0x000a0000,
2916                                         &s->low_mem_container,
2917                                         1);
2918     memory_region_set_coalescing(&s->low_mem);
2919 
2920     /* I/O handler for LFB */
2921     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2922                           "cirrus-linear-io", s->vga.vram_size_mb
2923                                               * 1024 * 1024);
2924     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2925 
2926     /* I/O handler for LFB */
2927     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2928                           &cirrus_linear_bitblt_io_ops,
2929                           s,
2930                           "cirrus-bitblt-mmio",
2931                           0x400000);
2932     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2933 
2934     /* I/O handler for memory-mapped I/O */
2935     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2936                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2937     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2938 
2939     s->real_vram_size =
2940         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
2941 
2942     /* XXX: s->vga.vram_size must be a power of two */
2943     s->cirrus_addr_mask = s->real_vram_size - 1;
2944     s->linear_mmio_mask = s->real_vram_size - 256;
2945 
2946     s->vga.get_bpp = cirrus_get_bpp;
2947     s->vga.get_offsets = cirrus_get_offsets;
2948     s->vga.get_resolution = cirrus_get_resolution;
2949     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2950     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2951 
2952     qemu_register_reset(cirrus_reset, s);
2953 }
2954 
2955 /***************************************
2956  *
2957  *  ISA bus support
2958  *
2959  ***************************************/
2960 
2961 static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
2962 {
2963     ISADevice *isadev = ISA_DEVICE(dev);
2964     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
2965     VGACommonState *s = &d->cirrus_vga.vga;
2966 
2967     /* follow real hardware, cirrus card emulated has 4 MB video memory.
2968        Also accept 8 MB/16 MB for backward compatibility. */
2969     if (s->vram_size_mb != 4 && s->vram_size_mb != 8 &&
2970         s->vram_size_mb != 16) {
2971         error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2972                    s->vram_size_mb);
2973         return;
2974     }
2975     vga_common_init(s, OBJECT(dev), true);
2976     cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
2977                        isa_address_space(isadev),
2978                        isa_address_space_io(isadev));
2979     s->con = graphic_console_init(dev, 0, s->hw_ops, s);
2980     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
2981     /* XXX ISA-LFB support */
2982     /* FIXME not qdev yet */
2983 }
2984 
2985 static Property isa_cirrus_vga_properties[] = {
2986     DEFINE_PROP_UINT32("vgamem_mb", struct ISACirrusVGAState,
2987                        cirrus_vga.vga.vram_size_mb, 8),
2988     DEFINE_PROP_END_OF_LIST(),
2989 };
2990 
2991 static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
2992 {
2993     DeviceClass *dc = DEVICE_CLASS(klass);
2994 
2995     dc->vmsd  = &vmstate_cirrus_vga;
2996     dc->realize = isa_cirrus_vga_realizefn;
2997     dc->props = isa_cirrus_vga_properties;
2998     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
2999 }
3000 
3001 static const TypeInfo isa_cirrus_vga_info = {
3002     .name          = TYPE_ISA_CIRRUS_VGA,
3003     .parent        = TYPE_ISA_DEVICE,
3004     .instance_size = sizeof(ISACirrusVGAState),
3005     .class_init = isa_cirrus_vga_class_init,
3006 };
3007 
3008 /***************************************
3009  *
3010  *  PCI bus support
3011  *
3012  ***************************************/
3013 
3014 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
3015 {
3016      PCICirrusVGAState *d = PCI_CIRRUS_VGA(dev);
3017      CirrusVGAState *s = &d->cirrus_vga;
3018      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
3019      int16_t device_id = pc->device_id;
3020 
3021      /* follow real hardware, cirrus card emulated has 4 MB video memory.
3022        Also accept 8 MB/16 MB for backward compatibility. */
3023      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
3024          s->vga.vram_size_mb != 16) {
3025          error_setg(errp, "Invalid cirrus_vga ram size '%u'",
3026                     s->vga.vram_size_mb);
3027          return;
3028      }
3029      /* setup VGA */
3030      vga_common_init(&s->vga, OBJECT(dev), true);
3031      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
3032                         pci_address_space_io(dev));
3033      s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
3034 
3035      /* setup PCI */
3036 
3037     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
3038 
3039     /* XXX: add byte swapping apertures */
3040     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
3041     memory_region_add_subregion(&s->pci_bar, 0x1000000,
3042                                 &s->cirrus_linear_bitblt_io);
3043 
3044      /* setup memory space */
3045      /* memory #0 LFB */
3046      /* memory #1 memory-mapped I/O */
3047      /* XXX: s->vga.vram_size must be a power of two */
3048      pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
3049      if (device_id == CIRRUS_ID_CLGD5446) {
3050          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
3051      }
3052 }
3053 
3054 static Property pci_vga_cirrus_properties[] = {
3055     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
3056                        cirrus_vga.vga.vram_size_mb, 8),
3057     DEFINE_PROP_END_OF_LIST(),
3058 };
3059 
3060 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
3061 {
3062     DeviceClass *dc = DEVICE_CLASS(klass);
3063     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3064 
3065     k->realize = pci_cirrus_vga_realize;
3066     k->romfile = VGABIOS_CIRRUS_FILENAME;
3067     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
3068     k->device_id = CIRRUS_ID_CLGD5446;
3069     k->class_id = PCI_CLASS_DISPLAY_VGA;
3070     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3071     dc->desc = "Cirrus CLGD 54xx VGA";
3072     dc->vmsd = &vmstate_pci_cirrus_vga;
3073     dc->props = pci_vga_cirrus_properties;
3074     dc->hotpluggable = false;
3075 }
3076 
3077 static const TypeInfo cirrus_vga_info = {
3078     .name          = TYPE_PCI_CIRRUS_VGA,
3079     .parent        = TYPE_PCI_DEVICE,
3080     .instance_size = sizeof(PCICirrusVGAState),
3081     .class_init    = cirrus_vga_class_init,
3082 };
3083 
3084 static void cirrus_vga_register_types(void)
3085 {
3086     type_register_static(&isa_cirrus_vga_info);
3087     type_register_static(&cirrus_vga_info);
3088 }
3089 
3090 type_init(cirrus_vga_register_types)
3091