xref: /qemu/hw/display/cirrus_vga.c (revision f9b925fd)
1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b:
27  *
28  *  http://web.archive.org/web/20021019054927/http://home.worldonline.dk/finth/
29  *
30  * VGADOC4b.ZIP content available at:
31  *
32  *  https://pdos.csail.mit.edu/6.828/2005/readings/hardware/vgadoc
33  */
34 
35 #include "qemu/osdep.h"
36 #include "qemu/module.h"
37 #include "qemu/units.h"
38 #include "qemu/log.h"
39 #include "sysemu/reset.h"
40 #include "qapi/error.h"
41 #include "trace.h"
42 #include "hw/pci/pci_device.h"
43 #include "hw/qdev-properties.h"
44 #include "migration/vmstate.h"
45 #include "ui/pixel_ops.h"
46 #include "cirrus_vga_internal.h"
47 #include "qom/object.h"
48 #include "ui/console.h"
49 
50 /*
51  * TODO:
52  *    - destination write mask support not complete (bits 5..7)
53  *    - optimize linear mappings
54  *    - optimize bitblt functions
55  */
56 
57 //#define DEBUG_CIRRUS
58 
59 /***************************************
60  *
61  *  definitions
62  *
63  ***************************************/
64 
65 // sequencer 0x07
66 #define CIRRUS_SR7_BPP_VGA            0x00
67 #define CIRRUS_SR7_BPP_SVGA           0x01
68 #define CIRRUS_SR7_BPP_MASK           0x0e
69 #define CIRRUS_SR7_BPP_8              0x00
70 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
71 #define CIRRUS_SR7_BPP_24             0x04
72 #define CIRRUS_SR7_BPP_16             0x06
73 #define CIRRUS_SR7_BPP_32             0x08
74 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
75 
76 // sequencer 0x0f
77 #define CIRRUS_MEMSIZE_512k        0x08
78 #define CIRRUS_MEMSIZE_1M          0x10
79 #define CIRRUS_MEMSIZE_2M          0x18
80 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80 // bank switching is enabled.
81 
82 // sequencer 0x12
83 #define CIRRUS_CURSOR_SHOW         0x01
84 #define CIRRUS_CURSOR_HIDDENPEL    0x02
85 #define CIRRUS_CURSOR_LARGE        0x04 // 64x64 if set, 32x32 if clear
86 
87 // sequencer 0x17
88 #define CIRRUS_BUSTYPE_VLBFAST   0x10
89 #define CIRRUS_BUSTYPE_PCI       0x20
90 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
91 #define CIRRUS_BUSTYPE_ISA       0x38
92 #define CIRRUS_MMIO_ENABLE       0x04
93 #define CIRRUS_MMIO_USE_PCIADDR  0x40   // 0xb8000 if cleared.
94 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
95 
96 // control 0x0b
97 #define CIRRUS_BANKING_DUAL             0x01
98 #define CIRRUS_BANKING_GRANULARITY_16K  0x20    // set:16k, clear:4k
99 
100 // control 0x30
101 #define CIRRUS_BLTMODE_BACKWARDS        0x01
102 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
103 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
104 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
105 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
106 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
107 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
108 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
109 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
110 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
111 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
112 
113 // control 0x31
114 #define CIRRUS_BLT_BUSY                 0x01
115 #define CIRRUS_BLT_START                0x02
116 #define CIRRUS_BLT_RESET                0x04
117 #define CIRRUS_BLT_FIFOUSED             0x10
118 #define CIRRUS_BLT_AUTOSTART            0x80
119 
120 // control 0x32
121 #define CIRRUS_ROP_0                    0x00
122 #define CIRRUS_ROP_SRC_AND_DST          0x05
123 #define CIRRUS_ROP_NOP                  0x06
124 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
125 #define CIRRUS_ROP_NOTDST               0x0b
126 #define CIRRUS_ROP_SRC                  0x0d
127 #define CIRRUS_ROP_1                    0x0e
128 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
129 #define CIRRUS_ROP_SRC_XOR_DST          0x59
130 #define CIRRUS_ROP_SRC_OR_DST           0x6d
131 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
132 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
133 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
134 #define CIRRUS_ROP_NOTSRC               0xd0
135 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
136 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
137 
138 #define CIRRUS_ROP_NOP_INDEX 2
139 #define CIRRUS_ROP_SRC_INDEX 5
140 
141 // control 0x33
142 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
143 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
144 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
145 
146 // memory-mapped IO
147 #define CIRRUS_MMIO_BLTBGCOLOR        0x00      // dword
148 #define CIRRUS_MMIO_BLTFGCOLOR        0x04      // dword
149 #define CIRRUS_MMIO_BLTWIDTH          0x08      // word
150 #define CIRRUS_MMIO_BLTHEIGHT         0x0a      // word
151 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c      // word
152 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e      // word
153 #define CIRRUS_MMIO_BLTDESTADDR       0x10      // dword
154 #define CIRRUS_MMIO_BLTSRCADDR        0x14      // dword
155 #define CIRRUS_MMIO_BLTWRITEMASK      0x17      // byte
156 #define CIRRUS_MMIO_BLTMODE           0x18      // byte
157 #define CIRRUS_MMIO_BLTROP            0x1a      // byte
158 #define CIRRUS_MMIO_BLTMODEEXT        0x1b      // byte
159 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c    // word?
160 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20        // word?
161 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24     // word
162 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26     // word
163 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28      // word
164 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a      // word
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c       // byte
166 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d  // byte
167 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e      // byte
168 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f     // byte
169 #define CIRRUS_MMIO_BRESENHAM_K1      0x30      // word
170 #define CIRRUS_MMIO_BRESENHAM_K3      0x32      // word
171 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34      // word
172 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36  // word
173 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38    // byte
174 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39      // byte
175 #define CIRRUS_MMIO_BLTSTATUS         0x40      // byte
176 
177 #define CIRRUS_PNPMMIO_SIZE         0x1000
178 
179 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
180                               uint32_t dstaddr, int dst_pitch,
181                               int width, int height);
182 
183 struct PCICirrusVGAState {
184     PCIDevice dev;
185     CirrusVGAState cirrus_vga;
186 };
187 
188 #define TYPE_PCI_CIRRUS_VGA "cirrus-vga"
189 OBJECT_DECLARE_SIMPLE_TYPE(PCICirrusVGAState, PCI_CIRRUS_VGA)
190 
191 static uint8_t rop_to_index[256];
192 
193 /***************************************
194  *
195  *  prototypes.
196  *
197  ***************************************/
198 
199 
200 static void cirrus_bitblt_reset(CirrusVGAState *s);
201 static void cirrus_update_memory_access(CirrusVGAState *s);
202 
203 /***************************************
204  *
205  *  raster operations
206  *
207  ***************************************/
208 
209 static bool blit_region_is_unsafe(struct CirrusVGAState *s,
210                                   int32_t pitch, int32_t addr)
211 {
212     if (!pitch) {
213         return true;
214     }
215     if (pitch < 0) {
216         int64_t min = addr
217             + ((int64_t)s->cirrus_blt_height - 1) * pitch
218             - s->cirrus_blt_width;
219         if (min < -1 || addr >= s->vga.vram_size) {
220             return true;
221         }
222     } else {
223         int64_t max = addr
224             + ((int64_t)s->cirrus_blt_height-1) * pitch
225             + s->cirrus_blt_width;
226         if (max > s->vga.vram_size) {
227             return true;
228         }
229     }
230     return false;
231 }
232 
233 static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)
234 {
235     /* should be the case, see cirrus_bitblt_start */
236     assert(s->cirrus_blt_width > 0);
237     assert(s->cirrus_blt_height > 0);
238 
239     if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
240         return true;
241     }
242 
243     if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
244                               s->cirrus_blt_dstaddr)) {
245         return true;
246     }
247     if (dst_only) {
248         return false;
249     }
250     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
251                               s->cirrus_blt_srcaddr)) {
252         return true;
253     }
254 
255     return false;
256 }
257 
258 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
259                                   uint32_t dstaddr, uint32_t srcaddr,
260                                   int dstpitch,int srcpitch,
261                                   int bltwidth,int bltheight)
262 {
263 }
264 
265 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
266                                    uint32_t dstaddr,
267                                    int dstpitch, int bltwidth,int bltheight)
268 {
269 }
270 
271 static inline uint8_t cirrus_src(CirrusVGAState *s, uint32_t srcaddr)
272 {
273     if (s->cirrus_srccounter) {
274         /* cputovideo */
275         return s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1)];
276     } else {
277         /* videotovideo */
278         return s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask];
279     }
280 }
281 
282 static inline uint16_t cirrus_src16(CirrusVGAState *s, uint32_t srcaddr)
283 {
284     uint16_t *src;
285 
286     if (s->cirrus_srccounter) {
287         /* cputovideo */
288         src = (void *)&s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1) & ~1];
289     } else {
290         /* videotovideo */
291         src = (void *)&s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask & ~1];
292     }
293     return *src;
294 }
295 
296 static inline uint32_t cirrus_src32(CirrusVGAState *s, uint32_t srcaddr)
297 {
298     uint32_t *src;
299 
300     if (s->cirrus_srccounter) {
301         /* cputovideo */
302         src = (void *)&s->cirrus_bltbuf[srcaddr & (CIRRUS_BLTBUFSIZE - 1) & ~3];
303     } else {
304         /* videotovideo */
305         src = (void *)&s->vga.vram_ptr[srcaddr & s->cirrus_addr_mask & ~3];
306     }
307     return *src;
308 }
309 
310 #define ROP_NAME 0
311 #define ROP_FN(d, s) 0
312 #include "cirrus_vga_rop.h"
313 
314 #define ROP_NAME src_and_dst
315 #define ROP_FN(d, s) (s) & (d)
316 #include "cirrus_vga_rop.h"
317 
318 #define ROP_NAME src_and_notdst
319 #define ROP_FN(d, s) (s) & (~(d))
320 #include "cirrus_vga_rop.h"
321 
322 #define ROP_NAME notdst
323 #define ROP_FN(d, s) ~(d)
324 #include "cirrus_vga_rop.h"
325 
326 #define ROP_NAME src
327 #define ROP_FN(d, s) s
328 #include "cirrus_vga_rop.h"
329 
330 #define ROP_NAME 1
331 #define ROP_FN(d, s) ~0
332 #include "cirrus_vga_rop.h"
333 
334 #define ROP_NAME notsrc_and_dst
335 #define ROP_FN(d, s) (~(s)) & (d)
336 #include "cirrus_vga_rop.h"
337 
338 #define ROP_NAME src_xor_dst
339 #define ROP_FN(d, s) (s) ^ (d)
340 #include "cirrus_vga_rop.h"
341 
342 #define ROP_NAME src_or_dst
343 #define ROP_FN(d, s) (s) | (d)
344 #include "cirrus_vga_rop.h"
345 
346 #define ROP_NAME notsrc_or_notdst
347 #define ROP_FN(d, s) (~(s)) | (~(d))
348 #include "cirrus_vga_rop.h"
349 
350 #define ROP_NAME src_notxor_dst
351 #define ROP_FN(d, s) ~((s) ^ (d))
352 #include "cirrus_vga_rop.h"
353 
354 #define ROP_NAME src_or_notdst
355 #define ROP_FN(d, s) (s) | (~(d))
356 #include "cirrus_vga_rop.h"
357 
358 #define ROP_NAME notsrc
359 #define ROP_FN(d, s) (~(s))
360 #include "cirrus_vga_rop.h"
361 
362 #define ROP_NAME notsrc_or_dst
363 #define ROP_FN(d, s) (~(s)) | (d)
364 #include "cirrus_vga_rop.h"
365 
366 #define ROP_NAME notsrc_and_notdst
367 #define ROP_FN(d, s) (~(s)) & (~(d))
368 #include "cirrus_vga_rop.h"
369 
370 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
371     cirrus_bitblt_rop_fwd_0,
372     cirrus_bitblt_rop_fwd_src_and_dst,
373     cirrus_bitblt_rop_nop,
374     cirrus_bitblt_rop_fwd_src_and_notdst,
375     cirrus_bitblt_rop_fwd_notdst,
376     cirrus_bitblt_rop_fwd_src,
377     cirrus_bitblt_rop_fwd_1,
378     cirrus_bitblt_rop_fwd_notsrc_and_dst,
379     cirrus_bitblt_rop_fwd_src_xor_dst,
380     cirrus_bitblt_rop_fwd_src_or_dst,
381     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
382     cirrus_bitblt_rop_fwd_src_notxor_dst,
383     cirrus_bitblt_rop_fwd_src_or_notdst,
384     cirrus_bitblt_rop_fwd_notsrc,
385     cirrus_bitblt_rop_fwd_notsrc_or_dst,
386     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
387 };
388 
389 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
390     cirrus_bitblt_rop_bkwd_0,
391     cirrus_bitblt_rop_bkwd_src_and_dst,
392     cirrus_bitblt_rop_nop,
393     cirrus_bitblt_rop_bkwd_src_and_notdst,
394     cirrus_bitblt_rop_bkwd_notdst,
395     cirrus_bitblt_rop_bkwd_src,
396     cirrus_bitblt_rop_bkwd_1,
397     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
398     cirrus_bitblt_rop_bkwd_src_xor_dst,
399     cirrus_bitblt_rop_bkwd_src_or_dst,
400     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
401     cirrus_bitblt_rop_bkwd_src_notxor_dst,
402     cirrus_bitblt_rop_bkwd_src_or_notdst,
403     cirrus_bitblt_rop_bkwd_notsrc,
404     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
405     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
406 };
407 
408 #define TRANSP_ROP(name) {\
409     name ## _8,\
410     name ## _16,\
411         }
412 #define TRANSP_NOP(func) {\
413     func,\
414     func,\
415         }
416 
417 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
418     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
419     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
420     TRANSP_NOP(cirrus_bitblt_rop_nop),
421     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
422     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
423     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
424     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
425     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
426     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
427     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
428     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
429     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
430     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
431     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
432     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
433     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
434 };
435 
436 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
437     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
438     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
439     TRANSP_NOP(cirrus_bitblt_rop_nop),
440     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
441     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
442     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
443     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
444     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
445     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
446     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
447     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
448     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
449     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
450     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
451     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
452     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
453 };
454 
455 #define ROP2(name) {\
456     name ## _8,\
457     name ## _16,\
458     name ## _24,\
459     name ## _32,\
460         }
461 
462 #define ROP_NOP2(func) {\
463     func,\
464     func,\
465     func,\
466     func,\
467         }
468 
469 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
470     ROP2(cirrus_patternfill_0),
471     ROP2(cirrus_patternfill_src_and_dst),
472     ROP_NOP2(cirrus_bitblt_rop_nop),
473     ROP2(cirrus_patternfill_src_and_notdst),
474     ROP2(cirrus_patternfill_notdst),
475     ROP2(cirrus_patternfill_src),
476     ROP2(cirrus_patternfill_1),
477     ROP2(cirrus_patternfill_notsrc_and_dst),
478     ROP2(cirrus_patternfill_src_xor_dst),
479     ROP2(cirrus_patternfill_src_or_dst),
480     ROP2(cirrus_patternfill_notsrc_or_notdst),
481     ROP2(cirrus_patternfill_src_notxor_dst),
482     ROP2(cirrus_patternfill_src_or_notdst),
483     ROP2(cirrus_patternfill_notsrc),
484     ROP2(cirrus_patternfill_notsrc_or_dst),
485     ROP2(cirrus_patternfill_notsrc_and_notdst),
486 };
487 
488 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
489     ROP2(cirrus_colorexpand_transp_0),
490     ROP2(cirrus_colorexpand_transp_src_and_dst),
491     ROP_NOP2(cirrus_bitblt_rop_nop),
492     ROP2(cirrus_colorexpand_transp_src_and_notdst),
493     ROP2(cirrus_colorexpand_transp_notdst),
494     ROP2(cirrus_colorexpand_transp_src),
495     ROP2(cirrus_colorexpand_transp_1),
496     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
497     ROP2(cirrus_colorexpand_transp_src_xor_dst),
498     ROP2(cirrus_colorexpand_transp_src_or_dst),
499     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
500     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
501     ROP2(cirrus_colorexpand_transp_src_or_notdst),
502     ROP2(cirrus_colorexpand_transp_notsrc),
503     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
504     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
505 };
506 
507 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
508     ROP2(cirrus_colorexpand_0),
509     ROP2(cirrus_colorexpand_src_and_dst),
510     ROP_NOP2(cirrus_bitblt_rop_nop),
511     ROP2(cirrus_colorexpand_src_and_notdst),
512     ROP2(cirrus_colorexpand_notdst),
513     ROP2(cirrus_colorexpand_src),
514     ROP2(cirrus_colorexpand_1),
515     ROP2(cirrus_colorexpand_notsrc_and_dst),
516     ROP2(cirrus_colorexpand_src_xor_dst),
517     ROP2(cirrus_colorexpand_src_or_dst),
518     ROP2(cirrus_colorexpand_notsrc_or_notdst),
519     ROP2(cirrus_colorexpand_src_notxor_dst),
520     ROP2(cirrus_colorexpand_src_or_notdst),
521     ROP2(cirrus_colorexpand_notsrc),
522     ROP2(cirrus_colorexpand_notsrc_or_dst),
523     ROP2(cirrus_colorexpand_notsrc_and_notdst),
524 };
525 
526 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
527     ROP2(cirrus_colorexpand_pattern_transp_0),
528     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
529     ROP_NOP2(cirrus_bitblt_rop_nop),
530     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
531     ROP2(cirrus_colorexpand_pattern_transp_notdst),
532     ROP2(cirrus_colorexpand_pattern_transp_src),
533     ROP2(cirrus_colorexpand_pattern_transp_1),
534     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
535     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
536     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
537     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
538     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
539     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
540     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
541     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
542     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
543 };
544 
545 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
546     ROP2(cirrus_colorexpand_pattern_0),
547     ROP2(cirrus_colorexpand_pattern_src_and_dst),
548     ROP_NOP2(cirrus_bitblt_rop_nop),
549     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
550     ROP2(cirrus_colorexpand_pattern_notdst),
551     ROP2(cirrus_colorexpand_pattern_src),
552     ROP2(cirrus_colorexpand_pattern_1),
553     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
554     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
555     ROP2(cirrus_colorexpand_pattern_src_or_dst),
556     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
557     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
558     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
559     ROP2(cirrus_colorexpand_pattern_notsrc),
560     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
561     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
562 };
563 
564 static const cirrus_fill_t cirrus_fill[16][4] = {
565     ROP2(cirrus_fill_0),
566     ROP2(cirrus_fill_src_and_dst),
567     ROP_NOP2(cirrus_bitblt_fill_nop),
568     ROP2(cirrus_fill_src_and_notdst),
569     ROP2(cirrus_fill_notdst),
570     ROP2(cirrus_fill_src),
571     ROP2(cirrus_fill_1),
572     ROP2(cirrus_fill_notsrc_and_dst),
573     ROP2(cirrus_fill_src_xor_dst),
574     ROP2(cirrus_fill_src_or_dst),
575     ROP2(cirrus_fill_notsrc_or_notdst),
576     ROP2(cirrus_fill_src_notxor_dst),
577     ROP2(cirrus_fill_src_or_notdst),
578     ROP2(cirrus_fill_notsrc),
579     ROP2(cirrus_fill_notsrc_or_dst),
580     ROP2(cirrus_fill_notsrc_and_notdst),
581 };
582 
583 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
584 {
585     unsigned int color;
586     switch (s->cirrus_blt_pixelwidth) {
587     case 1:
588         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
589         break;
590     case 2:
591         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
592         s->cirrus_blt_fgcol = le16_to_cpu(color);
593         break;
594     case 3:
595         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
596             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
597         break;
598     default:
599     case 4:
600         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
601             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
602         s->cirrus_blt_fgcol = le32_to_cpu(color);
603         break;
604     }
605 }
606 
607 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
608 {
609     unsigned int color;
610     switch (s->cirrus_blt_pixelwidth) {
611     case 1:
612         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
613         break;
614     case 2:
615         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
616         s->cirrus_blt_bgcol = le16_to_cpu(color);
617         break;
618     case 3:
619         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
620             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
621         break;
622     default:
623     case 4:
624         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
625             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
626         s->cirrus_blt_bgcol = le32_to_cpu(color);
627         break;
628     }
629 }
630 
631 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
632                                      int off_pitch, int bytesperline,
633                                      int lines)
634 {
635     int y;
636     int off_cur;
637     int off_cur_end;
638 
639     if (off_pitch < 0) {
640         off_begin -= bytesperline - 1;
641     }
642 
643     for (y = 0; y < lines; y++) {
644         off_cur = off_begin & s->cirrus_addr_mask;
645         off_cur_end = ((off_cur + bytesperline - 1) & s->cirrus_addr_mask) + 1;
646         if (off_cur_end >= off_cur) {
647             memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur);
648         } else {
649             /* wraparound */
650             memory_region_set_dirty(&s->vga.vram, off_cur,
651                                     s->cirrus_addr_mask + 1 - off_cur);
652             memory_region_set_dirty(&s->vga.vram, 0, off_cur_end);
653         }
654         off_begin += off_pitch;
655     }
656 }
657 
658 static int cirrus_bitblt_common_patterncopy(CirrusVGAState *s)
659 {
660     uint32_t patternsize;
661     bool videosrc = !s->cirrus_srccounter;
662 
663     if (videosrc) {
664         switch (s->vga.get_bpp(&s->vga)) {
665         case 8:
666             patternsize = 64;
667             break;
668         case 15:
669         case 16:
670             patternsize = 128;
671             break;
672         case 24:
673         case 32:
674         default:
675             patternsize = 256;
676             break;
677         }
678         s->cirrus_blt_srcaddr &= ~(patternsize - 1);
679         if (s->cirrus_blt_srcaddr + patternsize > s->vga.vram_size) {
680             return 0;
681         }
682     }
683 
684     if (blit_is_unsafe(s, true)) {
685         return 0;
686     }
687 
688     (*s->cirrus_rop) (s, s->cirrus_blt_dstaddr,
689                       videosrc ? s->cirrus_blt_srcaddr : 0,
690                       s->cirrus_blt_dstpitch, 0,
691                       s->cirrus_blt_width, s->cirrus_blt_height);
692     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
693                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
694                              s->cirrus_blt_height);
695     return 1;
696 }
697 
698 /* fill */
699 
700 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
701 {
702     cirrus_fill_t rop_func;
703 
704     if (blit_is_unsafe(s, true)) {
705         return 0;
706     }
707     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
708     rop_func(s, s->cirrus_blt_dstaddr,
709              s->cirrus_blt_dstpitch,
710              s->cirrus_blt_width, s->cirrus_blt_height);
711     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
712                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
713                              s->cirrus_blt_height);
714     cirrus_bitblt_reset(s);
715     return 1;
716 }
717 
718 /***************************************
719  *
720  *  bitblt (video-to-video)
721  *
722  ***************************************/
723 
724 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
725 {
726     return cirrus_bitblt_common_patterncopy(s);
727 }
728 
729 static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
730 {
731     int sx = 0, sy = 0;
732     int dx = 0, dy = 0;
733     int depth = 0;
734     int notify = 0;
735 
736     /* make sure to only copy if it's a plain copy ROP */
737     if (*s->cirrus_rop == cirrus_bitblt_rop_fwd_src ||
738         *s->cirrus_rop == cirrus_bitblt_rop_bkwd_src) {
739 
740         int width, height;
741 
742         depth = s->vga.get_bpp(&s->vga) / 8;
743         if (!depth) {
744             return 0;
745         }
746         s->vga.get_resolution(&s->vga, &width, &height);
747 
748         /* extra x, y */
749         sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
750         sy = (src / ABS(s->cirrus_blt_srcpitch));
751         dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
752         dy = (dst / ABS(s->cirrus_blt_dstpitch));
753 
754         /* normalize width */
755         w /= depth;
756 
757         /* if we're doing a backward copy, we have to adjust
758            our x/y to be the upper left corner (instead of the lower
759            right corner) */
760         if (s->cirrus_blt_dstpitch < 0) {
761             sx -= (s->cirrus_blt_width / depth) - 1;
762             dx -= (s->cirrus_blt_width / depth) - 1;
763             sy -= s->cirrus_blt_height - 1;
764             dy -= s->cirrus_blt_height - 1;
765         }
766 
767         /* are we in the visible portion of memory? */
768         if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
769             (sx + w) <= width && (sy + h) <= height &&
770             (dx + w) <= width && (dy + h) <= height) {
771             notify = 1;
772         }
773     }
774 
775     (*s->cirrus_rop) (s, s->cirrus_blt_dstaddr,
776                       s->cirrus_blt_srcaddr,
777                       s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
778                       s->cirrus_blt_width, s->cirrus_blt_height);
779 
780     if (notify) {
781         dpy_gfx_update(s->vga.con, dx, dy,
782                        s->cirrus_blt_width / depth,
783                        s->cirrus_blt_height);
784     }
785 
786     /* we don't have to notify the display that this portion has
787        changed since qemu_console_copy implies this */
788 
789     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
790                                 s->cirrus_blt_dstpitch, s->cirrus_blt_width,
791                                 s->cirrus_blt_height);
792 
793     return 1;
794 }
795 
796 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
797 {
798     if (blit_is_unsafe(s, false))
799         return 0;
800 
801     return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.params.start_addr,
802                           s->cirrus_blt_srcaddr - s->vga.params.start_addr,
803                           s->cirrus_blt_width, s->cirrus_blt_height);
804 }
805 
806 /***************************************
807  *
808  *  bitblt (cpu-to-video)
809  *
810  ***************************************/
811 
812 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
813 {
814     int copy_count;
815     uint8_t *end_ptr;
816 
817     if (s->cirrus_srccounter > 0) {
818         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
819             cirrus_bitblt_common_patterncopy(s);
820         the_end:
821             s->cirrus_srccounter = 0;
822             cirrus_bitblt_reset(s);
823         } else {
824             /* at least one scan line */
825             do {
826                 (*s->cirrus_rop)(s, s->cirrus_blt_dstaddr,
827                                  0, 0, 0, s->cirrus_blt_width, 1);
828                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
829                                          s->cirrus_blt_width, 1);
830                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
831                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
832                 if (s->cirrus_srccounter <= 0)
833                     goto the_end;
834                 /* more bytes than needed can be transferred because of
835                    word alignment, so we keep them for the next line */
836                 /* XXX: keep alignment to speed up transfer */
837                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
838                 copy_count = MIN(s->cirrus_srcptr_end - end_ptr, CIRRUS_BLTBUFSIZE);
839                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
840                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
841                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
842             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
843         }
844     }
845 }
846 
847 /***************************************
848  *
849  *  bitblt wrapper
850  *
851  ***************************************/
852 
853 static void cirrus_bitblt_reset(CirrusVGAState * s)
854 {
855     int need_update;
856 
857     s->vga.gr[0x31] &=
858         ~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
859     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
860         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
861     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
862     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
863     s->cirrus_srccounter = 0;
864     if (!need_update)
865         return;
866     cirrus_update_memory_access(s);
867 }
868 
869 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
870 {
871     int w;
872 
873     if (blit_is_unsafe(s, true)) {
874         return 0;
875     }
876 
877     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
878     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
879     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
880 
881     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
882         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
883             s->cirrus_blt_srcpitch = 8;
884         } else {
885             /* XXX: check for 24 bpp */
886             s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
887         }
888         s->cirrus_srccounter = s->cirrus_blt_srcpitch;
889     } else {
890         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
891             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
892             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
893                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
894             else
895                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
896         } else {
897             /* always align input size to 32 bits */
898             s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
899         }
900         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
901     }
902 
903     /* the blit_is_unsafe call above should catch this */
904     assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
905 
906     s->cirrus_srcptr = s->cirrus_bltbuf;
907     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
908     cirrus_update_memory_access(s);
909     return 1;
910 }
911 
912 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
913 {
914     /* XXX */
915     qemu_log_mask(LOG_UNIMP,
916                   "cirrus: bitblt (video to cpu) is not implemented\n");
917     return 0;
918 }
919 
920 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
921 {
922     int ret;
923 
924     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
925         ret = cirrus_bitblt_videotovideo_patterncopy(s);
926     } else {
927         ret = cirrus_bitblt_videotovideo_copy(s);
928     }
929     if (ret)
930         cirrus_bitblt_reset(s);
931     return ret;
932 }
933 
934 static void cirrus_bitblt_start(CirrusVGAState * s)
935 {
936     uint8_t blt_rop;
937 
938     if (!s->enable_blitter) {
939         goto bitblt_ignore;
940     }
941 
942     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
943 
944     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
945     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
946     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
947     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
948     s->cirrus_blt_dstaddr =
949         (s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
950     s->cirrus_blt_srcaddr =
951         (s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
952     s->cirrus_blt_mode = s->vga.gr[0x30];
953     s->cirrus_blt_modeext = s->vga.gr[0x33];
954     blt_rop = s->vga.gr[0x32];
955 
956     s->cirrus_blt_dstaddr &= s->cirrus_addr_mask;
957     s->cirrus_blt_srcaddr &= s->cirrus_addr_mask;
958 
959     trace_vga_cirrus_bitblt_start(blt_rop,
960                                   s->cirrus_blt_mode,
961                                   s->cirrus_blt_modeext,
962                                   s->cirrus_blt_width,
963                                   s->cirrus_blt_height,
964                                   s->cirrus_blt_dstpitch,
965                                   s->cirrus_blt_srcpitch,
966                                   s->cirrus_blt_dstaddr,
967                                   s->cirrus_blt_srcaddr,
968                                   s->vga.gr[0x2f]);
969 
970     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
971     case CIRRUS_BLTMODE_PIXELWIDTH8:
972         s->cirrus_blt_pixelwidth = 1;
973         break;
974     case CIRRUS_BLTMODE_PIXELWIDTH16:
975         s->cirrus_blt_pixelwidth = 2;
976         break;
977     case CIRRUS_BLTMODE_PIXELWIDTH24:
978         s->cirrus_blt_pixelwidth = 3;
979         break;
980     case CIRRUS_BLTMODE_PIXELWIDTH32:
981         s->cirrus_blt_pixelwidth = 4;
982         break;
983     default:
984         qemu_log_mask(LOG_GUEST_ERROR,
985                       "cirrus: bitblt - pixel width is unknown\n");
986         goto bitblt_ignore;
987     }
988     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
989 
990     if ((s->
991          cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
992                             CIRRUS_BLTMODE_MEMSYSDEST))
993         == (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
994         qemu_log_mask(LOG_UNIMP,
995                       "cirrus: bitblt - memory-to-memory copy requested\n");
996         goto bitblt_ignore;
997     }
998 
999     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
1000         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
1001                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
1002                                CIRRUS_BLTMODE_PATTERNCOPY |
1003                                CIRRUS_BLTMODE_COLOREXPAND)) ==
1004          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
1005         cirrus_bitblt_fgcol(s);
1006         cirrus_bitblt_solidfill(s, blt_rop);
1007     } else {
1008         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
1009                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
1010             CIRRUS_BLTMODE_COLOREXPAND) {
1011 
1012             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1013                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1014                     cirrus_bitblt_bgcol(s);
1015                 else
1016                     cirrus_bitblt_fgcol(s);
1017                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1018             } else {
1019                 cirrus_bitblt_fgcol(s);
1020                 cirrus_bitblt_bgcol(s);
1021                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1022             }
1023         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
1024             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
1025                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1026                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1027                         cirrus_bitblt_bgcol(s);
1028                     else
1029                         cirrus_bitblt_fgcol(s);
1030                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1031                 } else {
1032                     cirrus_bitblt_fgcol(s);
1033                     cirrus_bitblt_bgcol(s);
1034                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1035                 }
1036             } else {
1037                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1038             }
1039         } else {
1040             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1041                 if (s->cirrus_blt_pixelwidth > 2) {
1042                     qemu_log_mask(LOG_GUEST_ERROR,
1043                                   "cirrus: src transparent without colorexpand "
1044                                   "must be 8bpp or 16bpp\n");
1045                     goto bitblt_ignore;
1046                 }
1047                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1048                     s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1049                     s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1050                     s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1051                 } else {
1052                     s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1053                 }
1054             } else {
1055                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1056                     s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1057                     s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1058                     s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1059                 } else {
1060                     s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1061                 }
1062             }
1063         }
1064         // setup bitblt engine.
1065         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1066             if (!cirrus_bitblt_cputovideo(s))
1067                 goto bitblt_ignore;
1068         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1069             if (!cirrus_bitblt_videotocpu(s))
1070                 goto bitblt_ignore;
1071         } else {
1072             if (!cirrus_bitblt_videotovideo(s))
1073                 goto bitblt_ignore;
1074         }
1075     }
1076     return;
1077   bitblt_ignore:;
1078     cirrus_bitblt_reset(s);
1079 }
1080 
1081 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1082 {
1083     unsigned old_value;
1084 
1085     old_value = s->vga.gr[0x31];
1086     s->vga.gr[0x31] = reg_value;
1087 
1088     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1089         ((reg_value & CIRRUS_BLT_RESET) == 0)) {
1090         cirrus_bitblt_reset(s);
1091     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1092                ((reg_value & CIRRUS_BLT_START) != 0)) {
1093         cirrus_bitblt_start(s);
1094     }
1095 }
1096 
1097 
1098 /***************************************
1099  *
1100  *  basic parameters
1101  *
1102  ***************************************/
1103 
1104 static void cirrus_get_params(VGACommonState *s1,
1105                               VGADisplayParams *params)
1106 {
1107     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1108     uint32_t line_offset;
1109 
1110     line_offset = s->vga.cr[0x13]
1111         | ((s->vga.cr[0x1b] & 0x10) << 4);
1112     line_offset <<= 3;
1113     params->line_offset = line_offset;
1114 
1115     params->start_addr = (s->vga.cr[0x0c] << 8)
1116         | s->vga.cr[0x0d]
1117         | ((s->vga.cr[0x1b] & 0x01) << 16)
1118         | ((s->vga.cr[0x1b] & 0x0c) << 15)
1119         | ((s->vga.cr[0x1d] & 0x80) << 12);
1120 
1121     params->line_compare = s->vga.cr[0x18] |
1122         ((s->vga.cr[0x07] & 0x10) << 4) |
1123         ((s->vga.cr[0x09] & 0x40) << 3);
1124 }
1125 
1126 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1127 {
1128     uint32_t ret = 16;
1129 
1130     switch (s->cirrus_hidden_dac_data & 0xf) {
1131     case 0:
1132         ret = 15;
1133         break;                  /* Sierra HiColor */
1134     case 1:
1135         ret = 16;
1136         break;                  /* XGA HiColor */
1137     default:
1138         qemu_log_mask(LOG_GUEST_ERROR,
1139                       "cirrus: invalid DAC value 0x%x in 16bpp\n",
1140                       (s->cirrus_hidden_dac_data & 0xf));
1141         ret = 15;               /* XXX */
1142         break;
1143     }
1144     return ret;
1145 }
1146 
1147 static int cirrus_get_bpp(VGACommonState *s1)
1148 {
1149     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1150     uint32_t ret = 8;
1151 
1152     if ((s->vga.sr[0x07] & 0x01) != 0) {
1153         /* Cirrus SVGA */
1154         switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1155         case CIRRUS_SR7_BPP_8:
1156             ret = 8;
1157             break;
1158         case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1159             ret = cirrus_get_bpp16_depth(s);
1160             break;
1161         case CIRRUS_SR7_BPP_24:
1162             ret = 24;
1163             break;
1164         case CIRRUS_SR7_BPP_16:
1165             ret = cirrus_get_bpp16_depth(s);
1166             break;
1167         case CIRRUS_SR7_BPP_32:
1168             ret = 32;
1169             break;
1170         default:
1171 #ifdef DEBUG_CIRRUS
1172             printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1173 #endif
1174             ret = 8;
1175             break;
1176         }
1177     } else {
1178         /* VGA */
1179         ret = 0;
1180     }
1181 
1182     return ret;
1183 }
1184 
1185 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1186 {
1187     int width, height;
1188 
1189     width = (s->cr[0x01] + 1) * 8;
1190     height = s->cr[0x12] |
1191         ((s->cr[0x07] & 0x02) << 7) |
1192         ((s->cr[0x07] & 0x40) << 3);
1193     height = (height + 1);
1194     /* interlace support */
1195     if (s->cr[0x1a] & 0x01)
1196         height = height * 2;
1197     *pwidth = width;
1198     *pheight = height;
1199 }
1200 
1201 /***************************************
1202  *
1203  * bank memory
1204  *
1205  ***************************************/
1206 
1207 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1208 {
1209     unsigned offset;
1210     unsigned limit;
1211 
1212     if ((s->vga.gr[0x0b] & 0x01) != 0)  /* dual bank */
1213         offset = s->vga.gr[0x09 + bank_index];
1214     else                        /* single bank */
1215         offset = s->vga.gr[0x09];
1216 
1217     if ((s->vga.gr[0x0b] & 0x20) != 0)
1218         offset <<= 14;
1219     else
1220         offset <<= 12;
1221 
1222     if (s->real_vram_size <= offset)
1223         limit = 0;
1224     else
1225         limit = s->real_vram_size - offset;
1226 
1227     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1228         if (limit > 0x8000) {
1229             offset += 0x8000;
1230             limit -= 0x8000;
1231         } else {
1232             limit = 0;
1233         }
1234     }
1235 
1236     if (limit > 0) {
1237         s->cirrus_bank_base[bank_index] = offset;
1238         s->cirrus_bank_limit[bank_index] = limit;
1239     } else {
1240         s->cirrus_bank_base[bank_index] = 0;
1241         s->cirrus_bank_limit[bank_index] = 0;
1242     }
1243 }
1244 
1245 /***************************************
1246  *
1247  *  I/O access between 0x3c4-0x3c5
1248  *
1249  ***************************************/
1250 
1251 static int cirrus_vga_read_sr(CirrusVGAState * s)
1252 {
1253     switch (s->vga.sr_index) {
1254     case 0x00:                  // Standard VGA
1255     case 0x01:                  // Standard VGA
1256     case 0x02:                  // Standard VGA
1257     case 0x03:                  // Standard VGA
1258     case 0x04:                  // Standard VGA
1259         return s->vga.sr[s->vga.sr_index];
1260     case 0x06:                  // Unlock Cirrus extensions
1261         return s->vga.sr[s->vga.sr_index];
1262     case 0x10:
1263     case 0x30:
1264     case 0x50:
1265     case 0x70:                  // Graphics Cursor X
1266     case 0x90:
1267     case 0xb0:
1268     case 0xd0:
1269     case 0xf0:                  // Graphics Cursor X
1270         return s->vga.sr[0x10];
1271     case 0x11:
1272     case 0x31:
1273     case 0x51:
1274     case 0x71:                  // Graphics Cursor Y
1275     case 0x91:
1276     case 0xb1:
1277     case 0xd1:
1278     case 0xf1:                  // Graphics Cursor Y
1279         return s->vga.sr[0x11];
1280     case 0x05:                  // ???
1281     case 0x07:                  // Extended Sequencer Mode
1282     case 0x08:                  // EEPROM Control
1283     case 0x09:                  // Scratch Register 0
1284     case 0x0a:                  // Scratch Register 1
1285     case 0x0b:                  // VCLK 0
1286     case 0x0c:                  // VCLK 1
1287     case 0x0d:                  // VCLK 2
1288     case 0x0e:                  // VCLK 3
1289     case 0x0f:                  // DRAM Control
1290     case 0x12:                  // Graphics Cursor Attribute
1291     case 0x13:                  // Graphics Cursor Pattern Address
1292     case 0x14:                  // Scratch Register 2
1293     case 0x15:                  // Scratch Register 3
1294     case 0x16:                  // Performance Tuning Register
1295     case 0x17:                  // Configuration Readback and Extended Control
1296     case 0x18:                  // Signature Generator Control
1297     case 0x19:                  // Signal Generator Result
1298     case 0x1a:                  // Signal Generator Result
1299     case 0x1b:                  // VCLK 0 Denominator & Post
1300     case 0x1c:                  // VCLK 1 Denominator & Post
1301     case 0x1d:                  // VCLK 2 Denominator & Post
1302     case 0x1e:                  // VCLK 3 Denominator & Post
1303     case 0x1f:                  // BIOS Write Enable and MCLK select
1304 #ifdef DEBUG_CIRRUS
1305         printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1306 #endif
1307         return s->vga.sr[s->vga.sr_index];
1308     default:
1309         qemu_log_mask(LOG_GUEST_ERROR,
1310                       "cirrus: inport sr_index 0x%02x\n", s->vga.sr_index);
1311         return 0xff;
1312     }
1313 }
1314 
1315 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1316 {
1317     switch (s->vga.sr_index) {
1318     case 0x00:                  // Standard VGA
1319     case 0x01:                  // Standard VGA
1320     case 0x02:                  // Standard VGA
1321     case 0x03:                  // Standard VGA
1322     case 0x04:                  // Standard VGA
1323         s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1324         if (s->vga.sr_index == 1)
1325             s->vga.update_retrace_info(&s->vga);
1326         break;
1327     case 0x06:                  // Unlock Cirrus extensions
1328         val &= 0x17;
1329         if (val == 0x12) {
1330             s->vga.sr[s->vga.sr_index] = 0x12;
1331         } else {
1332             s->vga.sr[s->vga.sr_index] = 0x0f;
1333         }
1334         break;
1335     case 0x10:
1336     case 0x30:
1337     case 0x50:
1338     case 0x70:                  // Graphics Cursor X
1339     case 0x90:
1340     case 0xb0:
1341     case 0xd0:
1342     case 0xf0:                  // Graphics Cursor X
1343         s->vga.sr[0x10] = val;
1344         s->vga.hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1345         break;
1346     case 0x11:
1347     case 0x31:
1348     case 0x51:
1349     case 0x71:                  // Graphics Cursor Y
1350     case 0x91:
1351     case 0xb1:
1352     case 0xd1:
1353     case 0xf1:                  // Graphics Cursor Y
1354         s->vga.sr[0x11] = val;
1355         s->vga.hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1356         break;
1357     case 0x07:                  // Extended Sequencer Mode
1358         cirrus_update_memory_access(s);
1359         /* fall through */
1360     case 0x08:                  // EEPROM Control
1361     case 0x09:                  // Scratch Register 0
1362     case 0x0a:                  // Scratch Register 1
1363     case 0x0b:                  // VCLK 0
1364     case 0x0c:                  // VCLK 1
1365     case 0x0d:                  // VCLK 2
1366     case 0x0e:                  // VCLK 3
1367     case 0x0f:                  // DRAM Control
1368     case 0x13:                  // Graphics Cursor Pattern Address
1369     case 0x14:                  // Scratch Register 2
1370     case 0x15:                  // Scratch Register 3
1371     case 0x16:                  // Performance Tuning Register
1372     case 0x18:                  // Signature Generator Control
1373     case 0x19:                  // Signature Generator Result
1374     case 0x1a:                  // Signature Generator Result
1375     case 0x1b:                  // VCLK 0 Denominator & Post
1376     case 0x1c:                  // VCLK 1 Denominator & Post
1377     case 0x1d:                  // VCLK 2 Denominator & Post
1378     case 0x1e:                  // VCLK 3 Denominator & Post
1379     case 0x1f:                  // BIOS Write Enable and MCLK select
1380         s->vga.sr[s->vga.sr_index] = val;
1381 #ifdef DEBUG_CIRRUS
1382         printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1383                s->vga.sr_index, val);
1384 #endif
1385         break;
1386     case 0x12:                  // Graphics Cursor Attribute
1387         s->vga.sr[0x12] = val;
1388         s->vga.force_shadow = !!(val & CIRRUS_CURSOR_SHOW);
1389 #ifdef DEBUG_CIRRUS
1390         printf("cirrus: cursor ctl SR12=%02x (force shadow: %d)\n",
1391                val, s->vga.force_shadow);
1392 #endif
1393         break;
1394     case 0x17:                  // Configuration Readback and Extended Control
1395         s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1396                                    | (val & 0xc7);
1397         cirrus_update_memory_access(s);
1398         break;
1399     default:
1400         qemu_log_mask(LOG_GUEST_ERROR,
1401                       "cirrus: outport sr_index 0x%02x, sr_value 0x%02x\n",
1402                       s->vga.sr_index, val);
1403         break;
1404     }
1405 }
1406 
1407 /***************************************
1408  *
1409  *  I/O access at 0x3c6
1410  *
1411  ***************************************/
1412 
1413 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1414 {
1415     if (++s->cirrus_hidden_dac_lockindex == 5) {
1416         s->cirrus_hidden_dac_lockindex = 0;
1417         return s->cirrus_hidden_dac_data;
1418     }
1419     return 0xff;
1420 }
1421 
1422 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1423 {
1424     if (s->cirrus_hidden_dac_lockindex == 4) {
1425         s->cirrus_hidden_dac_data = reg_value;
1426 #if defined(DEBUG_CIRRUS)
1427         printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1428 #endif
1429     }
1430     s->cirrus_hidden_dac_lockindex = 0;
1431 }
1432 
1433 /***************************************
1434  *
1435  *  I/O access at 0x3c9
1436  *
1437  ***************************************/
1438 
1439 static int cirrus_vga_read_palette(CirrusVGAState * s)
1440 {
1441     int val;
1442 
1443     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1444         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1445                                        s->vga.dac_sub_index];
1446     } else {
1447         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1448     }
1449     if (++s->vga.dac_sub_index == 3) {
1450         s->vga.dac_sub_index = 0;
1451         s->vga.dac_read_index++;
1452     }
1453     return val;
1454 }
1455 
1456 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1457 {
1458     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1459     if (++s->vga.dac_sub_index == 3) {
1460         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1461             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1462                    s->vga.dac_cache, 3);
1463         } else {
1464             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1465         }
1466         /* XXX update cursor */
1467         s->vga.dac_sub_index = 0;
1468         s->vga.dac_write_index++;
1469     }
1470 }
1471 
1472 /***************************************
1473  *
1474  *  I/O access between 0x3ce-0x3cf
1475  *
1476  ***************************************/
1477 
1478 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1479 {
1480     switch (reg_index) {
1481     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1482         return s->cirrus_shadow_gr0;
1483     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1484         return s->cirrus_shadow_gr1;
1485     case 0x02:                  // Standard VGA
1486     case 0x03:                  // Standard VGA
1487     case 0x04:                  // Standard VGA
1488     case 0x06:                  // Standard VGA
1489     case 0x07:                  // Standard VGA
1490     case 0x08:                  // Standard VGA
1491         return s->vga.gr[s->vga.gr_index];
1492     case 0x05:                  // Standard VGA, Cirrus extended mode
1493     default:
1494         break;
1495     }
1496 
1497     if (reg_index < 0x3a) {
1498         return s->vga.gr[reg_index];
1499     } else {
1500         qemu_log_mask(LOG_GUEST_ERROR,
1501                       "cirrus: inport gr_index 0x%02x\n", reg_index);
1502         return 0xff;
1503     }
1504 }
1505 
1506 static void
1507 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1508 {
1509     trace_vga_cirrus_write_gr(reg_index, reg_value);
1510     switch (reg_index) {
1511     case 0x00:                  // Standard VGA, BGCOLOR 0x000000ff
1512         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1513         s->cirrus_shadow_gr0 = reg_value;
1514         break;
1515     case 0x01:                  // Standard VGA, FGCOLOR 0x000000ff
1516         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1517         s->cirrus_shadow_gr1 = reg_value;
1518         break;
1519     case 0x02:                  // Standard VGA
1520     case 0x03:                  // Standard VGA
1521     case 0x04:                  // Standard VGA
1522     case 0x06:                  // Standard VGA
1523     case 0x07:                  // Standard VGA
1524     case 0x08:                  // Standard VGA
1525         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1526         break;
1527     case 0x05:                  // Standard VGA, Cirrus extended mode
1528         s->vga.gr[reg_index] = reg_value & 0x7f;
1529         cirrus_update_memory_access(s);
1530         break;
1531     case 0x09:                  // bank offset #0
1532     case 0x0A:                  // bank offset #1
1533         s->vga.gr[reg_index] = reg_value;
1534         cirrus_update_bank_ptr(s, 0);
1535         cirrus_update_bank_ptr(s, 1);
1536         cirrus_update_memory_access(s);
1537         break;
1538     case 0x0B:
1539         s->vga.gr[reg_index] = reg_value;
1540         cirrus_update_bank_ptr(s, 0);
1541         cirrus_update_bank_ptr(s, 1);
1542         cirrus_update_memory_access(s);
1543         break;
1544     case 0x10:                  // BGCOLOR 0x0000ff00
1545     case 0x11:                  // FGCOLOR 0x0000ff00
1546     case 0x12:                  // BGCOLOR 0x00ff0000
1547     case 0x13:                  // FGCOLOR 0x00ff0000
1548     case 0x14:                  // BGCOLOR 0xff000000
1549     case 0x15:                  // FGCOLOR 0xff000000
1550     case 0x20:                  // BLT WIDTH 0x0000ff
1551     case 0x22:                  // BLT HEIGHT 0x0000ff
1552     case 0x24:                  // BLT DEST PITCH 0x0000ff
1553     case 0x26:                  // BLT SRC PITCH 0x0000ff
1554     case 0x28:                  // BLT DEST ADDR 0x0000ff
1555     case 0x29:                  // BLT DEST ADDR 0x00ff00
1556     case 0x2c:                  // BLT SRC ADDR 0x0000ff
1557     case 0x2d:                  // BLT SRC ADDR 0x00ff00
1558     case 0x2f:                  // BLT WRITEMASK
1559     case 0x30:                  // BLT MODE
1560     case 0x32:                  // RASTER OP
1561     case 0x33:                  // BLT MODEEXT
1562     case 0x34:                  // BLT TRANSPARENT COLOR 0x00ff
1563     case 0x35:                  // BLT TRANSPARENT COLOR 0xff00
1564     case 0x38:                  // BLT TRANSPARENT COLOR MASK 0x00ff
1565     case 0x39:                  // BLT TRANSPARENT COLOR MASK 0xff00
1566         s->vga.gr[reg_index] = reg_value;
1567         break;
1568     case 0x21:                  // BLT WIDTH 0x001f00
1569     case 0x23:                  // BLT HEIGHT 0x001f00
1570     case 0x25:                  // BLT DEST PITCH 0x001f00
1571     case 0x27:                  // BLT SRC PITCH 0x001f00
1572         s->vga.gr[reg_index] = reg_value & 0x1f;
1573         break;
1574     case 0x2a:                  // BLT DEST ADDR 0x3f0000
1575         s->vga.gr[reg_index] = reg_value & 0x3f;
1576         /* if auto start mode, starts bit blt now */
1577         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1578             cirrus_bitblt_start(s);
1579         }
1580         break;
1581     case 0x2e:                  // BLT SRC ADDR 0x3f0000
1582         s->vga.gr[reg_index] = reg_value & 0x3f;
1583         break;
1584     case 0x31:                  // BLT STATUS/START
1585         cirrus_write_bitblt(s, reg_value);
1586         break;
1587     default:
1588         qemu_log_mask(LOG_GUEST_ERROR,
1589                       "cirrus: outport gr_index 0x%02x, gr_value 0x%02x\n",
1590                       reg_index, reg_value);
1591         break;
1592     }
1593 }
1594 
1595 /***************************************
1596  *
1597  *  I/O access between 0x3d4-0x3d5
1598  *
1599  ***************************************/
1600 
1601 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1602 {
1603     switch (reg_index) {
1604     case 0x00:                  // Standard VGA
1605     case 0x01:                  // Standard VGA
1606     case 0x02:                  // Standard VGA
1607     case 0x03:                  // Standard VGA
1608     case 0x04:                  // Standard VGA
1609     case 0x05:                  // Standard VGA
1610     case 0x06:                  // Standard VGA
1611     case 0x07:                  // Standard VGA
1612     case 0x08:                  // Standard VGA
1613     case 0x09:                  // Standard VGA
1614     case 0x0a:                  // Standard VGA
1615     case 0x0b:                  // Standard VGA
1616     case 0x0c:                  // Standard VGA
1617     case 0x0d:                  // Standard VGA
1618     case 0x0e:                  // Standard VGA
1619     case 0x0f:                  // Standard VGA
1620     case 0x10:                  // Standard VGA
1621     case 0x11:                  // Standard VGA
1622     case 0x12:                  // Standard VGA
1623     case 0x13:                  // Standard VGA
1624     case 0x14:                  // Standard VGA
1625     case 0x15:                  // Standard VGA
1626     case 0x16:                  // Standard VGA
1627     case 0x17:                  // Standard VGA
1628     case 0x18:                  // Standard VGA
1629         return s->vga.cr[s->vga.cr_index];
1630     case 0x24:                  // Attribute Controller Toggle Readback (R)
1631         return (s->vga.ar_flip_flop << 7);
1632     case 0x19:                  // Interlace End
1633     case 0x1a:                  // Miscellaneous Control
1634     case 0x1b:                  // Extended Display Control
1635     case 0x1c:                  // Sync Adjust and Genlock
1636     case 0x1d:                  // Overlay Extended Control
1637     case 0x22:                  // Graphics Data Latches Readback (R)
1638     case 0x25:                  // Part Status
1639     case 0x27:                  // Part ID (R)
1640         return s->vga.cr[s->vga.cr_index];
1641     case 0x26:                  // Attribute Controller Index Readback (R)
1642         return s->vga.ar_index & 0x3f;
1643     default:
1644         qemu_log_mask(LOG_GUEST_ERROR,
1645                       "cirrus: inport cr_index 0x%02x\n", reg_index);
1646         return 0xff;
1647     }
1648 }
1649 
1650 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1651 {
1652     switch (s->vga.cr_index) {
1653     case 0x00:                  // Standard VGA
1654     case 0x01:                  // Standard VGA
1655     case 0x02:                  // Standard VGA
1656     case 0x03:                  // Standard VGA
1657     case 0x04:                  // Standard VGA
1658     case 0x05:                  // Standard VGA
1659     case 0x06:                  // Standard VGA
1660     case 0x07:                  // Standard VGA
1661     case 0x08:                  // Standard VGA
1662     case 0x09:                  // Standard VGA
1663     case 0x0a:                  // Standard VGA
1664     case 0x0b:                  // Standard VGA
1665     case 0x0c:                  // Standard VGA
1666     case 0x0d:                  // Standard VGA
1667     case 0x0e:                  // Standard VGA
1668     case 0x0f:                  // Standard VGA
1669     case 0x10:                  // Standard VGA
1670     case 0x11:                  // Standard VGA
1671     case 0x12:                  // Standard VGA
1672     case 0x13:                  // Standard VGA
1673     case 0x14:                  // Standard VGA
1674     case 0x15:                  // Standard VGA
1675     case 0x16:                  // Standard VGA
1676     case 0x17:                  // Standard VGA
1677     case 0x18:                  // Standard VGA
1678         /* handle CR0-7 protection */
1679         if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1680             /* can always write bit 4 of CR7 */
1681             if (s->vga.cr_index == 7)
1682                 s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1683             return;
1684         }
1685         s->vga.cr[s->vga.cr_index] = reg_value;
1686         switch(s->vga.cr_index) {
1687         case 0x00:
1688         case 0x04:
1689         case 0x05:
1690         case 0x06:
1691         case 0x07:
1692         case 0x11:
1693         case 0x17:
1694             s->vga.update_retrace_info(&s->vga);
1695             break;
1696         }
1697         break;
1698     case 0x19:                  // Interlace End
1699     case 0x1a:                  // Miscellaneous Control
1700     case 0x1b:                  // Extended Display Control
1701     case 0x1c:                  // Sync Adjust and Genlock
1702     case 0x1d:                  // Overlay Extended Control
1703         s->vga.cr[s->vga.cr_index] = reg_value;
1704 #ifdef DEBUG_CIRRUS
1705         printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1706                s->vga.cr_index, reg_value);
1707 #endif
1708         break;
1709     case 0x22:                  // Graphics Data Latches Readback (R)
1710     case 0x24:                  // Attribute Controller Toggle Readback (R)
1711     case 0x26:                  // Attribute Controller Index Readback (R)
1712     case 0x27:                  // Part ID (R)
1713         break;
1714     case 0x25:                  // Part Status
1715     default:
1716         qemu_log_mask(LOG_GUEST_ERROR,
1717                       "cirrus: outport cr_index 0x%02x, cr_value 0x%02x\n",
1718                       s->vga.cr_index, reg_value);
1719         break;
1720     }
1721 }
1722 
1723 /***************************************
1724  *
1725  *  memory-mapped I/O (bitblt)
1726  *
1727  ***************************************/
1728 
1729 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1730 {
1731     int value = 0xff;
1732 
1733     switch (address) {
1734     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1735         value = cirrus_vga_read_gr(s, 0x00);
1736         break;
1737     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1738         value = cirrus_vga_read_gr(s, 0x10);
1739         break;
1740     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1741         value = cirrus_vga_read_gr(s, 0x12);
1742         break;
1743     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1744         value = cirrus_vga_read_gr(s, 0x14);
1745         break;
1746     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1747         value = cirrus_vga_read_gr(s, 0x01);
1748         break;
1749     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1750         value = cirrus_vga_read_gr(s, 0x11);
1751         break;
1752     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1753         value = cirrus_vga_read_gr(s, 0x13);
1754         break;
1755     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1756         value = cirrus_vga_read_gr(s, 0x15);
1757         break;
1758     case (CIRRUS_MMIO_BLTWIDTH + 0):
1759         value = cirrus_vga_read_gr(s, 0x20);
1760         break;
1761     case (CIRRUS_MMIO_BLTWIDTH + 1):
1762         value = cirrus_vga_read_gr(s, 0x21);
1763         break;
1764     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1765         value = cirrus_vga_read_gr(s, 0x22);
1766         break;
1767     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1768         value = cirrus_vga_read_gr(s, 0x23);
1769         break;
1770     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1771         value = cirrus_vga_read_gr(s, 0x24);
1772         break;
1773     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1774         value = cirrus_vga_read_gr(s, 0x25);
1775         break;
1776     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1777         value = cirrus_vga_read_gr(s, 0x26);
1778         break;
1779     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1780         value = cirrus_vga_read_gr(s, 0x27);
1781         break;
1782     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1783         value = cirrus_vga_read_gr(s, 0x28);
1784         break;
1785     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1786         value = cirrus_vga_read_gr(s, 0x29);
1787         break;
1788     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1789         value = cirrus_vga_read_gr(s, 0x2a);
1790         break;
1791     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1792         value = cirrus_vga_read_gr(s, 0x2c);
1793         break;
1794     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1795         value = cirrus_vga_read_gr(s, 0x2d);
1796         break;
1797     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1798         value = cirrus_vga_read_gr(s, 0x2e);
1799         break;
1800     case CIRRUS_MMIO_BLTWRITEMASK:
1801         value = cirrus_vga_read_gr(s, 0x2f);
1802         break;
1803     case CIRRUS_MMIO_BLTMODE:
1804         value = cirrus_vga_read_gr(s, 0x30);
1805         break;
1806     case CIRRUS_MMIO_BLTROP:
1807         value = cirrus_vga_read_gr(s, 0x32);
1808         break;
1809     case CIRRUS_MMIO_BLTMODEEXT:
1810         value = cirrus_vga_read_gr(s, 0x33);
1811         break;
1812     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1813         value = cirrus_vga_read_gr(s, 0x34);
1814         break;
1815     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1816         value = cirrus_vga_read_gr(s, 0x35);
1817         break;
1818     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1819         value = cirrus_vga_read_gr(s, 0x38);
1820         break;
1821     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1822         value = cirrus_vga_read_gr(s, 0x39);
1823         break;
1824     case CIRRUS_MMIO_BLTSTATUS:
1825         value = cirrus_vga_read_gr(s, 0x31);
1826         break;
1827     default:
1828         qemu_log_mask(LOG_GUEST_ERROR,
1829                       "cirrus: mmio read - address 0x%04x\n", address);
1830         break;
1831     }
1832 
1833     trace_vga_cirrus_write_blt(address, value);
1834     return (uint8_t) value;
1835 }
1836 
1837 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1838                                   uint8_t value)
1839 {
1840     trace_vga_cirrus_write_blt(address, value);
1841     switch (address) {
1842     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1843         cirrus_vga_write_gr(s, 0x00, value);
1844         break;
1845     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1846         cirrus_vga_write_gr(s, 0x10, value);
1847         break;
1848     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1849         cirrus_vga_write_gr(s, 0x12, value);
1850         break;
1851     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1852         cirrus_vga_write_gr(s, 0x14, value);
1853         break;
1854     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1855         cirrus_vga_write_gr(s, 0x01, value);
1856         break;
1857     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1858         cirrus_vga_write_gr(s, 0x11, value);
1859         break;
1860     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1861         cirrus_vga_write_gr(s, 0x13, value);
1862         break;
1863     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1864         cirrus_vga_write_gr(s, 0x15, value);
1865         break;
1866     case (CIRRUS_MMIO_BLTWIDTH + 0):
1867         cirrus_vga_write_gr(s, 0x20, value);
1868         break;
1869     case (CIRRUS_MMIO_BLTWIDTH + 1):
1870         cirrus_vga_write_gr(s, 0x21, value);
1871         break;
1872     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1873         cirrus_vga_write_gr(s, 0x22, value);
1874         break;
1875     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1876         cirrus_vga_write_gr(s, 0x23, value);
1877         break;
1878     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1879         cirrus_vga_write_gr(s, 0x24, value);
1880         break;
1881     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1882         cirrus_vga_write_gr(s, 0x25, value);
1883         break;
1884     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1885         cirrus_vga_write_gr(s, 0x26, value);
1886         break;
1887     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1888         cirrus_vga_write_gr(s, 0x27, value);
1889         break;
1890     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1891         cirrus_vga_write_gr(s, 0x28, value);
1892         break;
1893     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1894         cirrus_vga_write_gr(s, 0x29, value);
1895         break;
1896     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1897         cirrus_vga_write_gr(s, 0x2a, value);
1898         break;
1899     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1900         /* ignored */
1901         break;
1902     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1903         cirrus_vga_write_gr(s, 0x2c, value);
1904         break;
1905     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1906         cirrus_vga_write_gr(s, 0x2d, value);
1907         break;
1908     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1909         cirrus_vga_write_gr(s, 0x2e, value);
1910         break;
1911     case CIRRUS_MMIO_BLTWRITEMASK:
1912         cirrus_vga_write_gr(s, 0x2f, value);
1913         break;
1914     case CIRRUS_MMIO_BLTMODE:
1915         cirrus_vga_write_gr(s, 0x30, value);
1916         break;
1917     case CIRRUS_MMIO_BLTROP:
1918         cirrus_vga_write_gr(s, 0x32, value);
1919         break;
1920     case CIRRUS_MMIO_BLTMODEEXT:
1921         cirrus_vga_write_gr(s, 0x33, value);
1922         break;
1923     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1924         cirrus_vga_write_gr(s, 0x34, value);
1925         break;
1926     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1927         cirrus_vga_write_gr(s, 0x35, value);
1928         break;
1929     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1930         cirrus_vga_write_gr(s, 0x38, value);
1931         break;
1932     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1933         cirrus_vga_write_gr(s, 0x39, value);
1934         break;
1935     case CIRRUS_MMIO_BLTSTATUS:
1936         cirrus_vga_write_gr(s, 0x31, value);
1937         break;
1938     default:
1939         qemu_log_mask(LOG_GUEST_ERROR,
1940                       "cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1941                       address, value);
1942         break;
1943     }
1944 }
1945 
1946 /***************************************
1947  *
1948  *  write mode 4/5
1949  *
1950  ***************************************/
1951 
1952 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1953                                              unsigned mode,
1954                                              unsigned offset,
1955                                              uint32_t mem_value)
1956 {
1957     int x;
1958     unsigned val = mem_value;
1959     uint8_t *dst;
1960 
1961     for (x = 0; x < 8; x++) {
1962         dst = s->vga.vram_ptr + ((offset + x) & s->cirrus_addr_mask);
1963         if (val & 0x80) {
1964             *dst = s->cirrus_shadow_gr1;
1965         } else if (mode == 5) {
1966             *dst = s->cirrus_shadow_gr0;
1967         }
1968         val <<= 1;
1969     }
1970     memory_region_set_dirty(&s->vga.vram, offset, 8);
1971 }
1972 
1973 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1974                                               unsigned mode,
1975                                               unsigned offset,
1976                                               uint32_t mem_value)
1977 {
1978     int x;
1979     unsigned val = mem_value;
1980     uint8_t *dst;
1981 
1982     for (x = 0; x < 8; x++) {
1983         dst = s->vga.vram_ptr + ((offset + 2 * x) & s->cirrus_addr_mask & ~1);
1984         if (val & 0x80) {
1985             *dst = s->cirrus_shadow_gr1;
1986             *(dst + 1) = s->vga.gr[0x11];
1987         } else if (mode == 5) {
1988             *dst = s->cirrus_shadow_gr0;
1989             *(dst + 1) = s->vga.gr[0x10];
1990         }
1991         val <<= 1;
1992     }
1993     memory_region_set_dirty(&s->vga.vram, offset, 16);
1994 }
1995 
1996 /***************************************
1997  *
1998  *  memory access between 0xa0000-0xbffff
1999  *
2000  ***************************************/
2001 
2002 static uint64_t cirrus_vga_mem_read(void *opaque,
2003                                     hwaddr addr,
2004                                     uint32_t size)
2005 {
2006     CirrusVGAState *s = opaque;
2007     unsigned bank_index;
2008     unsigned bank_offset;
2009     uint32_t val;
2010 
2011     if ((s->vga.sr[0x07] & 0x01) == 0) {
2012         return vga_mem_readb(&s->vga, addr);
2013     }
2014 
2015     if (addr < 0x10000) {
2016         /* XXX handle bitblt */
2017         /* video memory */
2018         bank_index = addr >> 15;
2019         bank_offset = addr & 0x7fff;
2020         if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2021             bank_offset += s->cirrus_bank_base[bank_index];
2022             if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2023                 bank_offset <<= 4;
2024             } else if (s->vga.gr[0x0B] & 0x02) {
2025                 bank_offset <<= 3;
2026             }
2027             bank_offset &= s->cirrus_addr_mask;
2028             val = *(s->vga.vram_ptr + bank_offset);
2029         } else
2030             val = 0xff;
2031     } else if (addr >= 0x18000 && addr < 0x18100) {
2032         /* memory-mapped I/O */
2033         val = 0xff;
2034         if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2035             val = cirrus_mmio_blt_read(s, addr & 0xff);
2036         }
2037     } else {
2038         val = 0xff;
2039         qemu_log_mask(LOG_GUEST_ERROR,
2040                       "cirrus: mem_readb 0x" HWADDR_FMT_plx "\n", addr);
2041     }
2042     return val;
2043 }
2044 
2045 static void cirrus_vga_mem_write(void *opaque,
2046                                  hwaddr addr,
2047                                  uint64_t mem_value,
2048                                  uint32_t size)
2049 {
2050     CirrusVGAState *s = opaque;
2051     unsigned bank_index;
2052     unsigned bank_offset;
2053     unsigned mode;
2054 
2055     if ((s->vga.sr[0x07] & 0x01) == 0) {
2056         vga_mem_writeb(&s->vga, addr, mem_value);
2057         return;
2058     }
2059 
2060     if (addr < 0x10000) {
2061         if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2062             /* bitblt */
2063             *s->cirrus_srcptr++ = (uint8_t) mem_value;
2064             if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2065                 cirrus_bitblt_cputovideo_next(s);
2066             }
2067         } else {
2068             /* video memory */
2069             bank_index = addr >> 15;
2070             bank_offset = addr & 0x7fff;
2071             if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2072                 bank_offset += s->cirrus_bank_base[bank_index];
2073                 if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2074                     bank_offset <<= 4;
2075                 } else if (s->vga.gr[0x0B] & 0x02) {
2076                     bank_offset <<= 3;
2077                 }
2078                 bank_offset &= s->cirrus_addr_mask;
2079                 mode = s->vga.gr[0x05] & 0x7;
2080                 if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2081                     *(s->vga.vram_ptr + bank_offset) = mem_value;
2082                     memory_region_set_dirty(&s->vga.vram, bank_offset,
2083                                             sizeof(mem_value));
2084                 } else {
2085                     if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2086                         cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2087                                                          bank_offset,
2088                                                          mem_value);
2089                     } else {
2090                         cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2091                                                           bank_offset,
2092                                                           mem_value);
2093                     }
2094                 }
2095             }
2096         }
2097     } else if (addr >= 0x18000 && addr < 0x18100) {
2098         /* memory-mapped I/O */
2099         if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2100             cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2101         }
2102     } else {
2103         qemu_log_mask(LOG_GUEST_ERROR,
2104                       "cirrus: mem_writeb 0x" HWADDR_FMT_plx " "
2105                       "value 0x%02" PRIx64 "\n", addr, mem_value);
2106     }
2107 }
2108 
2109 static const MemoryRegionOps cirrus_vga_mem_ops = {
2110     .read = cirrus_vga_mem_read,
2111     .write = cirrus_vga_mem_write,
2112     .endianness = DEVICE_LITTLE_ENDIAN,
2113     .impl = {
2114         .min_access_size = 1,
2115         .max_access_size = 1,
2116     },
2117 };
2118 
2119 /***************************************
2120  *
2121  *  hardware cursor
2122  *
2123  ***************************************/
2124 
2125 static inline void invalidate_cursor1(CirrusVGAState *s)
2126 {
2127     if (s->last_hw_cursor_size) {
2128         vga_invalidate_scanlines(&s->vga,
2129                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2130                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2131     }
2132 }
2133 
2134 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2135 {
2136     const uint8_t *src;
2137     uint32_t content;
2138     int y, y_min, y_max;
2139 
2140     src = s->vga.vram_ptr + s->real_vram_size - 16 * KiB;
2141     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2142         src += (s->vga.sr[0x13] & 0x3c) * 256;
2143         y_min = 64;
2144         y_max = -1;
2145         for(y = 0; y < 64; y++) {
2146             content = ((uint32_t *)src)[0] |
2147                 ((uint32_t *)src)[1] |
2148                 ((uint32_t *)src)[2] |
2149                 ((uint32_t *)src)[3];
2150             if (content) {
2151                 if (y < y_min)
2152                     y_min = y;
2153                 if (y > y_max)
2154                     y_max = y;
2155             }
2156             src += 16;
2157         }
2158     } else {
2159         src += (s->vga.sr[0x13] & 0x3f) * 256;
2160         y_min = 32;
2161         y_max = -1;
2162         for(y = 0; y < 32; y++) {
2163             content = ((uint32_t *)src)[0] |
2164                 ((uint32_t *)(src + 128))[0];
2165             if (content) {
2166                 if (y < y_min)
2167                     y_min = y;
2168                 if (y > y_max)
2169                     y_max = y;
2170             }
2171             src += 4;
2172         }
2173     }
2174     if (y_min > y_max) {
2175         s->last_hw_cursor_y_start = 0;
2176         s->last_hw_cursor_y_end = 0;
2177     } else {
2178         s->last_hw_cursor_y_start = y_min;
2179         s->last_hw_cursor_y_end = y_max + 1;
2180     }
2181 }
2182 
2183 /* NOTE: we do not currently handle the cursor bitmap change, so we
2184    update the cursor only if it moves. */
2185 static void cirrus_cursor_invalidate(VGACommonState *s1)
2186 {
2187     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2188     int size;
2189 
2190     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2191         size = 0;
2192     } else {
2193         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2194             size = 64;
2195         else
2196             size = 32;
2197     }
2198     /* invalidate last cursor and new cursor if any change */
2199     if (s->last_hw_cursor_size != size ||
2200         s->last_hw_cursor_x != s->vga.hw_cursor_x ||
2201         s->last_hw_cursor_y != s->vga.hw_cursor_y) {
2202 
2203         invalidate_cursor1(s);
2204 
2205         s->last_hw_cursor_size = size;
2206         s->last_hw_cursor_x = s->vga.hw_cursor_x;
2207         s->last_hw_cursor_y = s->vga.hw_cursor_y;
2208         /* compute the real cursor min and max y */
2209         cirrus_cursor_compute_yrange(s);
2210         invalidate_cursor1(s);
2211     }
2212 }
2213 
2214 static void vga_draw_cursor_line(uint8_t *d1,
2215                                  const uint8_t *src1,
2216                                  int poffset, int w,
2217                                  unsigned int color0,
2218                                  unsigned int color1,
2219                                  unsigned int color_xor)
2220 {
2221     const uint8_t *plane0, *plane1;
2222     int x, b0, b1;
2223     uint8_t *d;
2224 
2225     d = d1;
2226     plane0 = src1;
2227     plane1 = src1 + poffset;
2228     for (x = 0; x < w; x++) {
2229         b0 = (plane0[x >> 3] >> (7 - (x & 7))) & 1;
2230         b1 = (plane1[x >> 3] >> (7 - (x & 7))) & 1;
2231         switch (b0 | (b1 << 1)) {
2232         case 0:
2233             break;
2234         case 1:
2235             ((uint32_t *)d)[0] ^= color_xor;
2236             break;
2237         case 2:
2238             ((uint32_t *)d)[0] = color0;
2239             break;
2240         case 3:
2241             ((uint32_t *)d)[0] = color1;
2242             break;
2243         }
2244         d += 4;
2245     }
2246 }
2247 
2248 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2249 {
2250     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2251     int w, h, x1, x2, poffset;
2252     unsigned int color0, color1;
2253     const uint8_t *palette, *src;
2254     uint32_t content;
2255 
2256     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2257         return;
2258     /* fast test to see if the cursor intersects with the scan line */
2259     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2260         h = 64;
2261     } else {
2262         h = 32;
2263     }
2264     if (scr_y < s->vga.hw_cursor_y ||
2265         scr_y >= (s->vga.hw_cursor_y + h)) {
2266         return;
2267     }
2268 
2269     src = s->vga.vram_ptr + s->real_vram_size - 16 * KiB;
2270     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2271         src += (s->vga.sr[0x13] & 0x3c) * 256;
2272         src += (scr_y - s->vga.hw_cursor_y) * 16;
2273         poffset = 8;
2274         content = ((uint32_t *)src)[0] |
2275             ((uint32_t *)src)[1] |
2276             ((uint32_t *)src)[2] |
2277             ((uint32_t *)src)[3];
2278     } else {
2279         src += (s->vga.sr[0x13] & 0x3f) * 256;
2280         src += (scr_y - s->vga.hw_cursor_y) * 4;
2281 
2282 
2283         poffset = 128;
2284         content = ((uint32_t *)src)[0] |
2285             ((uint32_t *)(src + 128))[0];
2286     }
2287     /* if nothing to draw, no need to continue */
2288     if (!content)
2289         return;
2290     w = h;
2291 
2292     x1 = s->vga.hw_cursor_x;
2293     if (x1 >= s->vga.last_scr_width)
2294         return;
2295     x2 = s->vga.hw_cursor_x + w;
2296     if (x2 > s->vga.last_scr_width)
2297         x2 = s->vga.last_scr_width;
2298     w = x2 - x1;
2299     palette = s->cirrus_hidden_palette;
2300     color0 = rgb_to_pixel32(c6_to_8(palette[0x0 * 3]),
2301                             c6_to_8(palette[0x0 * 3 + 1]),
2302                             c6_to_8(palette[0x0 * 3 + 2]));
2303     color1 = rgb_to_pixel32(c6_to_8(palette[0xf * 3]),
2304                             c6_to_8(palette[0xf * 3 + 1]),
2305                             c6_to_8(palette[0xf * 3 + 2]));
2306     d1 += x1 * 4;
2307     vga_draw_cursor_line(d1, src, poffset, w, color0, color1, 0xffffff);
2308 }
2309 
2310 /***************************************
2311  *
2312  *  LFB memory access
2313  *
2314  ***************************************/
2315 
2316 static uint64_t cirrus_linear_read(void *opaque, hwaddr addr,
2317                                    unsigned size)
2318 {
2319     CirrusVGAState *s = opaque;
2320     uint32_t ret;
2321 
2322     addr &= s->cirrus_addr_mask;
2323 
2324     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2325         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2326         /* memory-mapped I/O */
2327         ret = cirrus_mmio_blt_read(s, addr & 0xff);
2328     } else if (0) {
2329         /* XXX handle bitblt */
2330         ret = 0xff;
2331     } else {
2332         /* video memory */
2333         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2334             addr <<= 4;
2335         } else if (s->vga.gr[0x0B] & 0x02) {
2336             addr <<= 3;
2337         }
2338         addr &= s->cirrus_addr_mask;
2339         ret = *(s->vga.vram_ptr + addr);
2340     }
2341 
2342     return ret;
2343 }
2344 
2345 static void cirrus_linear_write(void *opaque, hwaddr addr,
2346                                 uint64_t val, unsigned size)
2347 {
2348     CirrusVGAState *s = opaque;
2349     unsigned mode;
2350 
2351     addr &= s->cirrus_addr_mask;
2352 
2353     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2354         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2355         /* memory-mapped I/O */
2356         cirrus_mmio_blt_write(s, addr & 0xff, val);
2357     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2358         /* bitblt */
2359         *s->cirrus_srcptr++ = (uint8_t) val;
2360         if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2361             cirrus_bitblt_cputovideo_next(s);
2362         }
2363     } else {
2364         /* video memory */
2365         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2366             addr <<= 4;
2367         } else if (s->vga.gr[0x0B] & 0x02) {
2368             addr <<= 3;
2369         }
2370         addr &= s->cirrus_addr_mask;
2371 
2372         mode = s->vga.gr[0x05] & 0x7;
2373         if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2374             *(s->vga.vram_ptr + addr) = (uint8_t) val;
2375             memory_region_set_dirty(&s->vga.vram, addr, 1);
2376         } else {
2377             if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2378                 cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2379             } else {
2380                 cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2381             }
2382         }
2383     }
2384 }
2385 
2386 /***************************************
2387  *
2388  *  system to screen memory access
2389  *
2390  ***************************************/
2391 
2392 
2393 static uint64_t cirrus_linear_bitblt_read(void *opaque,
2394                                           hwaddr addr,
2395                                           unsigned size)
2396 {
2397     CirrusVGAState *s = opaque;
2398 
2399     /* XXX handle bitblt */
2400     (void)s;
2401     qemu_log_mask(LOG_UNIMP,
2402                   "cirrus: linear bitblt is not implemented\n");
2403 
2404     return 0xff;
2405 }
2406 
2407 static void cirrus_linear_bitblt_write(void *opaque,
2408                                        hwaddr addr,
2409                                        uint64_t val,
2410                                        unsigned size)
2411 {
2412     CirrusVGAState *s = opaque;
2413 
2414     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2415         /* bitblt */
2416         *s->cirrus_srcptr++ = (uint8_t) val;
2417         if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2418             cirrus_bitblt_cputovideo_next(s);
2419         }
2420     }
2421 }
2422 
2423 static const MemoryRegionOps cirrus_linear_bitblt_io_ops = {
2424     .read = cirrus_linear_bitblt_read,
2425     .write = cirrus_linear_bitblt_write,
2426     .endianness = DEVICE_LITTLE_ENDIAN,
2427     .impl = {
2428         .min_access_size = 1,
2429         .max_access_size = 1,
2430     },
2431 };
2432 
2433 static void map_linear_vram_bank(CirrusVGAState *s, unsigned bank)
2434 {
2435     MemoryRegion *mr = &s->cirrus_bank[bank];
2436     bool enabled = !(s->cirrus_srcptr != s->cirrus_srcptr_end)
2437         && !((s->vga.sr[0x07] & 0x01) == 0)
2438         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2439         && !(s->vga.gr[0x0B] & 0x02);
2440 
2441     memory_region_set_enabled(mr, enabled);
2442     memory_region_set_alias_offset(mr, s->cirrus_bank_base[bank]);
2443 }
2444 
2445 static void map_linear_vram(CirrusVGAState *s)
2446 {
2447     if (s->bustype == CIRRUS_BUSTYPE_PCI && !s->linear_vram) {
2448         s->linear_vram = true;
2449         memory_region_add_subregion_overlap(&s->pci_bar, 0, &s->vga.vram, 1);
2450     }
2451     map_linear_vram_bank(s, 0);
2452     map_linear_vram_bank(s, 1);
2453 }
2454 
2455 static void unmap_linear_vram(CirrusVGAState *s)
2456 {
2457     if (s->bustype == CIRRUS_BUSTYPE_PCI && s->linear_vram) {
2458         s->linear_vram = false;
2459         memory_region_del_subregion(&s->pci_bar, &s->vga.vram);
2460     }
2461     memory_region_set_enabled(&s->cirrus_bank[0], false);
2462     memory_region_set_enabled(&s->cirrus_bank[1], false);
2463 }
2464 
2465 /* Compute the memory access functions */
2466 static void cirrus_update_memory_access(CirrusVGAState *s)
2467 {
2468     unsigned mode;
2469 
2470     memory_region_transaction_begin();
2471     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2472         goto generic_io;
2473     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2474         goto generic_io;
2475     } else {
2476         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2477             goto generic_io;
2478         } else if (s->vga.gr[0x0B] & 0x02) {
2479             goto generic_io;
2480         }
2481 
2482         mode = s->vga.gr[0x05] & 0x7;
2483         if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2484             map_linear_vram(s);
2485         } else {
2486         generic_io:
2487             unmap_linear_vram(s);
2488         }
2489     }
2490     memory_region_transaction_commit();
2491 }
2492 
2493 
2494 /* I/O ports */
2495 
2496 static uint64_t cirrus_vga_ioport_read(void *opaque, hwaddr addr,
2497                                        unsigned size)
2498 {
2499     CirrusVGAState *c = opaque;
2500     VGACommonState *s = &c->vga;
2501     int val, index;
2502 
2503     addr += 0x3b0;
2504 
2505     if (vga_ioport_invalid(s, addr)) {
2506         val = 0xff;
2507     } else {
2508         switch (addr) {
2509         case 0x3c0:
2510             if (s->ar_flip_flop == 0) {
2511                 val = s->ar_index;
2512             } else {
2513                 val = 0;
2514             }
2515             break;
2516         case 0x3c1:
2517             index = s->ar_index & 0x1f;
2518             if (index < 21)
2519                 val = s->ar[index];
2520             else
2521                 val = 0;
2522             break;
2523         case 0x3c2:
2524             val = s->st00;
2525             break;
2526         case 0x3c4:
2527             val = s->sr_index;
2528             break;
2529         case 0x3c5:
2530             val = cirrus_vga_read_sr(c);
2531             break;
2532             break;
2533         case 0x3c6:
2534             val = cirrus_read_hidden_dac(c);
2535             break;
2536         case 0x3c7:
2537             val = s->dac_state;
2538             break;
2539         case 0x3c8:
2540             val = s->dac_write_index;
2541             c->cirrus_hidden_dac_lockindex = 0;
2542             break;
2543         case 0x3c9:
2544             val = cirrus_vga_read_palette(c);
2545             break;
2546         case 0x3ca:
2547             val = s->fcr;
2548             break;
2549         case 0x3cc:
2550             val = s->msr;
2551             break;
2552         case 0x3ce:
2553             val = s->gr_index;
2554             break;
2555         case 0x3cf:
2556             val = cirrus_vga_read_gr(c, s->gr_index);
2557             break;
2558         case 0x3b4:
2559         case 0x3d4:
2560             val = s->cr_index;
2561             break;
2562         case 0x3b5:
2563         case 0x3d5:
2564             val = cirrus_vga_read_cr(c, s->cr_index);
2565             break;
2566         case 0x3ba:
2567         case 0x3da:
2568             /* just toggle to fool polling */
2569             val = s->st01 = s->retrace(s);
2570             s->ar_flip_flop = 0;
2571             break;
2572         default:
2573             val = 0x00;
2574             break;
2575         }
2576     }
2577     trace_vga_cirrus_read_io(addr, val);
2578     return val;
2579 }
2580 
2581 static void cirrus_vga_ioport_write(void *opaque, hwaddr addr, uint64_t val,
2582                                     unsigned size)
2583 {
2584     CirrusVGAState *c = opaque;
2585     VGACommonState *s = &c->vga;
2586     int index;
2587 
2588     addr += 0x3b0;
2589 
2590     /* check port range access depending on color/monochrome mode */
2591     if (vga_ioport_invalid(s, addr)) {
2592         return;
2593     }
2594     trace_vga_cirrus_write_io(addr, val);
2595 
2596     switch (addr) {
2597     case 0x3c0:
2598         if (s->ar_flip_flop == 0) {
2599             val &= 0x3f;
2600             s->ar_index = val;
2601         } else {
2602             index = s->ar_index & 0x1f;
2603             switch (index) {
2604             case 0x00 ... 0x0f:
2605                 s->ar[index] = val & 0x3f;
2606                 break;
2607             case 0x10:
2608                 s->ar[index] = val & ~0x10;
2609                 break;
2610             case 0x11:
2611                 s->ar[index] = val;
2612                 break;
2613             case 0x12:
2614                 s->ar[index] = val & ~0xc0;
2615                 break;
2616             case 0x13:
2617                 s->ar[index] = val & ~0xf0;
2618                 break;
2619             case 0x14:
2620                 s->ar[index] = val & ~0xf0;
2621                 break;
2622             default:
2623                 break;
2624             }
2625         }
2626         s->ar_flip_flop ^= 1;
2627         break;
2628     case 0x3c2:
2629         s->msr = val & ~0x10;
2630         s->update_retrace_info(s);
2631         break;
2632     case 0x3c4:
2633         s->sr_index = val;
2634         break;
2635     case 0x3c5:
2636         cirrus_vga_write_sr(c, val);
2637         break;
2638     case 0x3c6:
2639         cirrus_write_hidden_dac(c, val);
2640         break;
2641     case 0x3c7:
2642         s->dac_read_index = val;
2643         s->dac_sub_index = 0;
2644         s->dac_state = 3;
2645         break;
2646     case 0x3c8:
2647         s->dac_write_index = val;
2648         s->dac_sub_index = 0;
2649         s->dac_state = 0;
2650         break;
2651     case 0x3c9:
2652         cirrus_vga_write_palette(c, val);
2653         break;
2654     case 0x3ce:
2655         s->gr_index = val;
2656         break;
2657     case 0x3cf:
2658         cirrus_vga_write_gr(c, s->gr_index, val);
2659         break;
2660     case 0x3b4:
2661     case 0x3d4:
2662         s->cr_index = val;
2663         break;
2664     case 0x3b5:
2665     case 0x3d5:
2666         cirrus_vga_write_cr(c, val);
2667         break;
2668     case 0x3ba:
2669     case 0x3da:
2670         s->fcr = val & 0x10;
2671         break;
2672     }
2673 }
2674 
2675 /***************************************
2676  *
2677  *  memory-mapped I/O access
2678  *
2679  ***************************************/
2680 
2681 static uint64_t cirrus_mmio_read(void *opaque, hwaddr addr,
2682                                  unsigned size)
2683 {
2684     CirrusVGAState *s = opaque;
2685 
2686     if (addr >= 0x100) {
2687         return cirrus_mmio_blt_read(s, addr - 0x100);
2688     } else {
2689         return cirrus_vga_ioport_read(s, addr + 0x10, size);
2690     }
2691 }
2692 
2693 static void cirrus_mmio_write(void *opaque, hwaddr addr,
2694                               uint64_t val, unsigned size)
2695 {
2696     CirrusVGAState *s = opaque;
2697 
2698     if (addr >= 0x100) {
2699         cirrus_mmio_blt_write(s, addr - 0x100, val);
2700     } else {
2701         cirrus_vga_ioport_write(s, addr + 0x10, val, size);
2702     }
2703 }
2704 
2705 static const MemoryRegionOps cirrus_mmio_io_ops = {
2706     .read = cirrus_mmio_read,
2707     .write = cirrus_mmio_write,
2708     .endianness = DEVICE_LITTLE_ENDIAN,
2709     .impl = {
2710         .min_access_size = 1,
2711         .max_access_size = 1,
2712     },
2713 };
2714 
2715 /* load/save state */
2716 
2717 static int cirrus_post_load(void *opaque, int version_id)
2718 {
2719     CirrusVGAState *s = opaque;
2720 
2721     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2722     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2723 
2724     cirrus_update_bank_ptr(s, 0);
2725     cirrus_update_bank_ptr(s, 1);
2726     cirrus_update_memory_access(s);
2727     /* force refresh */
2728     s->vga.graphic_mode = -1;
2729 
2730     return 0;
2731 }
2732 
2733 const VMStateDescription vmstate_cirrus_vga = {
2734     .name = "cirrus_vga",
2735     .version_id = 2,
2736     .minimum_version_id = 1,
2737     .post_load = cirrus_post_load,
2738     .fields = (const VMStateField[]) {
2739         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2740         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2741         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2742         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2743         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2744         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2745         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2746         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2747         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2748         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2749         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2750         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
2751         VMSTATE_UINT8(vga.msr, CirrusVGAState),
2752         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
2753         VMSTATE_UINT8(vga.st00, CirrusVGAState),
2754         VMSTATE_UINT8(vga.st01, CirrusVGAState),
2755         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
2756         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
2757         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
2758         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
2759         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
2760         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
2761         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
2762         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
2763         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
2764         VMSTATE_UINT32(vga.hw_cursor_x, CirrusVGAState),
2765         VMSTATE_UINT32(vga.hw_cursor_y, CirrusVGAState),
2766         /* XXX: we do not save the bitblt state - we assume we do not save
2767            the state when the blitter is active */
2768         VMSTATE_END_OF_LIST()
2769     }
2770 };
2771 
2772 static const VMStateDescription vmstate_pci_cirrus_vga = {
2773     .name = "cirrus_vga",
2774     .version_id = 2,
2775     .minimum_version_id = 2,
2776     .fields = (const VMStateField[]) {
2777         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
2778         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
2779                        vmstate_cirrus_vga, CirrusVGAState),
2780         VMSTATE_END_OF_LIST()
2781     }
2782 };
2783 
2784 /***************************************
2785  *
2786  *  initialize
2787  *
2788  ***************************************/
2789 
2790 static void cirrus_reset(void *opaque)
2791 {
2792     CirrusVGAState *s = opaque;
2793 
2794     vga_common_reset(&s->vga);
2795     unmap_linear_vram(s);
2796     s->vga.sr[0x06] = 0x0f;
2797     if (s->device_id == CIRRUS_ID_CLGD5446) {
2798         /* 4MB 64 bit memory config, always PCI */
2799         s->vga.sr[0x1F] = 0x2d;         // MemClock
2800         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
2801         s->vga.sr[0x0f] = 0x98;
2802         s->vga.sr[0x17] = 0x20;
2803         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
2804     } else {
2805         s->vga.sr[0x1F] = 0x22;         // MemClock
2806         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
2807         s->vga.sr[0x17] = s->bustype;
2808         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
2809     }
2810     s->vga.cr[0x27] = s->device_id;
2811 
2812     s->cirrus_hidden_dac_lockindex = 5;
2813     s->cirrus_hidden_dac_data = 0;
2814 }
2815 
2816 static const MemoryRegionOps cirrus_linear_io_ops = {
2817     .read = cirrus_linear_read,
2818     .write = cirrus_linear_write,
2819     .endianness = DEVICE_LITTLE_ENDIAN,
2820     .impl = {
2821         .min_access_size = 1,
2822         .max_access_size = 1,
2823     },
2824 };
2825 
2826 static const MemoryRegionOps cirrus_vga_io_ops = {
2827     .read = cirrus_vga_ioport_read,
2828     .write = cirrus_vga_ioport_write,
2829     .endianness = DEVICE_LITTLE_ENDIAN,
2830     .impl = {
2831         .min_access_size = 1,
2832         .max_access_size = 1,
2833     },
2834 };
2835 
2836 void cirrus_init_common(CirrusVGAState *s, Object *owner,
2837                         int device_id, int is_pci,
2838                         MemoryRegion *system_memory, MemoryRegion *system_io)
2839 {
2840     int i;
2841     static int inited;
2842 
2843     if (!inited) {
2844         inited = 1;
2845         for(i = 0;i < 256; i++)
2846             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
2847         rop_to_index[CIRRUS_ROP_0] = 0;
2848         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
2849         rop_to_index[CIRRUS_ROP_NOP] = 2;
2850         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
2851         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
2852         rop_to_index[CIRRUS_ROP_SRC] = 5;
2853         rop_to_index[CIRRUS_ROP_1] = 6;
2854         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
2855         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
2856         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
2857         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
2858         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
2859         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
2860         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
2861         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
2862         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
2863         s->device_id = device_id;
2864         if (is_pci)
2865             s->bustype = CIRRUS_BUSTYPE_PCI;
2866         else
2867             s->bustype = CIRRUS_BUSTYPE_ISA;
2868     }
2869 
2870     /* Register ioport 0x3b0 - 0x3df */
2871     memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
2872                           "cirrus-io", 0x30);
2873     memory_region_set_flush_coalesced(&s->cirrus_vga_io);
2874     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
2875 
2876     memory_region_init(&s->low_mem_container, owner,
2877                        "cirrus-lowmem-container",
2878                        0x20000);
2879 
2880     memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
2881                           "cirrus-low-memory", 0x20000);
2882     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
2883     for (i = 0; i < 2; ++i) {
2884         static const char *names[] = { "vga.bank0", "vga.bank1" };
2885         MemoryRegion *bank = &s->cirrus_bank[i];
2886         memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
2887                                  0, 0x8000);
2888         memory_region_set_enabled(bank, false);
2889         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
2890                                             bank, 1);
2891     }
2892     memory_region_add_subregion_overlap(system_memory,
2893                                         0x000a0000,
2894                                         &s->low_mem_container,
2895                                         1);
2896     memory_region_set_coalescing(&s->low_mem);
2897 
2898     /* I/O handler for LFB */
2899     memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
2900                           "cirrus-linear-io", s->vga.vram_size_mb * MiB);
2901     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
2902 
2903     /* I/O handler for LFB */
2904     memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
2905                           &cirrus_linear_bitblt_io_ops,
2906                           s,
2907                           "cirrus-bitblt-mmio",
2908                           0x400000);
2909     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
2910 
2911     /* I/O handler for memory-mapped I/O */
2912     memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
2913                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
2914     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
2915 
2916     s->real_vram_size =
2917         (s->device_id == CIRRUS_ID_CLGD5446) ? 4 * MiB : 2 * MiB;
2918 
2919     /* XXX: s->vga.vram_size must be a power of two */
2920     s->cirrus_addr_mask = s->real_vram_size - 1;
2921     s->linear_mmio_mask = s->real_vram_size - 256;
2922 
2923     s->vga.get_bpp = cirrus_get_bpp;
2924     s->vga.get_params = cirrus_get_params;
2925     s->vga.get_resolution = cirrus_get_resolution;
2926     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
2927     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
2928 
2929     qemu_register_reset(cirrus_reset, s);
2930 }
2931 
2932 /***************************************
2933  *
2934  *  PCI bus support
2935  *
2936  ***************************************/
2937 
2938 static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
2939 {
2940     PCICirrusVGAState *d = PCI_CIRRUS_VGA(dev);
2941     CirrusVGAState *s = &d->cirrus_vga;
2942     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
2943     int16_t device_id = pc->device_id;
2944 
2945     /*
2946      * Follow real hardware, cirrus card emulated has 4 MB video memory.
2947      * Also accept 8 MB/16 MB for backward compatibility.
2948      */
2949     if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
2950         s->vga.vram_size_mb != 16) {
2951         error_setg(errp, "Invalid cirrus_vga ram size '%u'",
2952                    s->vga.vram_size_mb);
2953         return;
2954     }
2955     /* setup VGA */
2956     if (!vga_common_init(&s->vga, OBJECT(dev), errp)) {
2957         return;
2958     }
2959     cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
2960                        pci_address_space_io(dev));
2961     s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
2962 
2963     /* setup PCI */
2964     memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
2965 
2966     /* XXX: add byte swapping apertures */
2967     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
2968     memory_region_add_subregion(&s->pci_bar, 0x1000000,
2969                                 &s->cirrus_linear_bitblt_io);
2970 
2971     /* setup memory space */
2972     /* memory #0 LFB */
2973     /* memory #1 memory-mapped I/O */
2974     /* XXX: s->vga.vram_size must be a power of two */
2975     pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);
2976     if (device_id == CIRRUS_ID_CLGD5446) {
2977         pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
2978     }
2979 }
2980 
2981 static Property pci_vga_cirrus_properties[] = {
2982     DEFINE_PROP_UINT32("vgamem_mb", struct PCICirrusVGAState,
2983                        cirrus_vga.vga.vram_size_mb, 4),
2984     DEFINE_PROP_BOOL("blitter", struct PCICirrusVGAState,
2985                      cirrus_vga.enable_blitter, true),
2986     DEFINE_PROP_BOOL("global-vmstate", struct PCICirrusVGAState,
2987                      cirrus_vga.vga.global_vmstate, false),
2988     DEFINE_PROP_END_OF_LIST(),
2989 };
2990 
2991 static void cirrus_vga_class_init(ObjectClass *klass, void *data)
2992 {
2993     DeviceClass *dc = DEVICE_CLASS(klass);
2994     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2995 
2996     k->realize = pci_cirrus_vga_realize;
2997     k->romfile = VGABIOS_CIRRUS_FILENAME;
2998     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
2999     k->device_id = CIRRUS_ID_CLGD5446;
3000     k->class_id = PCI_CLASS_DISPLAY_VGA;
3001     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
3002     dc->desc = "Cirrus CLGD 54xx VGA";
3003     dc->vmsd = &vmstate_pci_cirrus_vga;
3004     device_class_set_props(dc, pci_vga_cirrus_properties);
3005     dc->hotpluggable = false;
3006 }
3007 
3008 static const TypeInfo cirrus_vga_info = {
3009     .name          = TYPE_PCI_CIRRUS_VGA,
3010     .parent        = TYPE_PCI_DEVICE,
3011     .instance_size = sizeof(PCICirrusVGAState),
3012     .class_init    = cirrus_vga_class_init,
3013     .interfaces = (InterfaceInfo[]) {
3014         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
3015         { },
3016     },
3017 };
3018 
3019 static void cirrus_vga_register_types(void)
3020 {
3021     type_register_static(&cirrus_vga_info);
3022 }
3023 
3024 type_init(cirrus_vga_register_types)
3025