xref: /qemu/hw/display/sm501.c (revision a193352f)
1 /*
2  * QEMU SM501 Device
3  *
4  * Copyright (c) 2008 Shin-ichiro KAWASAKI
5  * Copyright (c) 2016 BALATON Zoltan
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "qemu/units.h"
28 #include "qapi/error.h"
29 #include "qemu-common.h"
30 #include "cpu.h"
31 #include "hw/hw.h"
32 #include "hw/char/serial.h"
33 #include "ui/console.h"
34 #include "hw/devices.h"
35 #include "hw/sysbus.h"
36 #include "hw/pci/pci.h"
37 #include "qemu/range.h"
38 #include "ui/pixel_ops.h"
39 
40 /*
41  * Status: 2010/05/07
42  *   - Minimum implementation for Linux console : mmio regs and CRT layer.
43  *   - 2D graphics acceleration partially supported : only fill rectangle.
44  *
45  * Status: 2016/12/04
46  *   - Misc fixes: endianness, hardware cursor
47  *   - Panel support
48  *
49  * TODO:
50  *   - Touch panel support
51  *   - USB support
52  *   - UART support
53  *   - More 2D graphics engine support
54  *   - Performance tuning
55  */
56 
57 /*#define DEBUG_SM501*/
58 /*#define DEBUG_BITBLT*/
59 
60 #ifdef DEBUG_SM501
61 #define SM501_DPRINTF(fmt, ...) printf(fmt, ## __VA_ARGS__)
62 #else
63 #define SM501_DPRINTF(fmt, ...) do {} while (0)
64 #endif
65 
66 #define MMIO_BASE_OFFSET 0x3e00000
67 #define MMIO_SIZE 0x200000
68 #define DC_PALETTE_ENTRIES (0x400 * 3)
69 
70 /* SM501 register definitions taken from "linux/include/linux/sm501-regs.h" */
71 
72 /* System Configuration area */
73 /* System config base */
74 #define SM501_SYS_CONFIG                (0x000000)
75 
76 /* config 1 */
77 #define SM501_SYSTEM_CONTROL            (0x000000)
78 
79 #define SM501_SYSCTRL_PANEL_TRISTATE    (1 << 0)
80 #define SM501_SYSCTRL_MEM_TRISTATE      (1 << 1)
81 #define SM501_SYSCTRL_CRT_TRISTATE      (1 << 2)
82 
83 #define SM501_SYSCTRL_PCI_SLAVE_BURST_MASK (3 << 4)
84 #define SM501_SYSCTRL_PCI_SLAVE_BURST_1 (0 << 4)
85 #define SM501_SYSCTRL_PCI_SLAVE_BURST_2 (1 << 4)
86 #define SM501_SYSCTRL_PCI_SLAVE_BURST_4 (2 << 4)
87 #define SM501_SYSCTRL_PCI_SLAVE_BURST_8 (3 << 4)
88 
89 #define SM501_SYSCTRL_PCI_CLOCK_RUN_EN  (1 << 6)
90 #define SM501_SYSCTRL_PCI_RETRY_DISABLE (1 << 7)
91 #define SM501_SYSCTRL_PCI_SUBSYS_LOCK   (1 << 11)
92 #define SM501_SYSCTRL_PCI_BURST_READ_EN (1 << 15)
93 
94 /* miscellaneous control */
95 
96 #define SM501_MISC_CONTROL              (0x000004)
97 
98 #define SM501_MISC_BUS_SH               (0x0)
99 #define SM501_MISC_BUS_PCI              (0x1)
100 #define SM501_MISC_BUS_XSCALE           (0x2)
101 #define SM501_MISC_BUS_NEC              (0x6)
102 #define SM501_MISC_BUS_MASK             (0x7)
103 
104 #define SM501_MISC_VR_62MB              (1 << 3)
105 #define SM501_MISC_CDR_RESET            (1 << 7)
106 #define SM501_MISC_USB_LB               (1 << 8)
107 #define SM501_MISC_USB_SLAVE            (1 << 9)
108 #define SM501_MISC_BL_1                 (1 << 10)
109 #define SM501_MISC_MC                   (1 << 11)
110 #define SM501_MISC_DAC_POWER            (1 << 12)
111 #define SM501_MISC_IRQ_INVERT           (1 << 16)
112 #define SM501_MISC_SH                   (1 << 17)
113 
114 #define SM501_MISC_HOLD_EMPTY           (0 << 18)
115 #define SM501_MISC_HOLD_8               (1 << 18)
116 #define SM501_MISC_HOLD_16              (2 << 18)
117 #define SM501_MISC_HOLD_24              (3 << 18)
118 #define SM501_MISC_HOLD_32              (4 << 18)
119 #define SM501_MISC_HOLD_MASK            (7 << 18)
120 
121 #define SM501_MISC_FREQ_12              (1 << 24)
122 #define SM501_MISC_PNL_24BIT            (1 << 25)
123 #define SM501_MISC_8051_LE              (1 << 26)
124 
125 
126 
127 #define SM501_GPIO31_0_CONTROL          (0x000008)
128 #define SM501_GPIO63_32_CONTROL         (0x00000C)
129 #define SM501_DRAM_CONTROL              (0x000010)
130 
131 /* command list */
132 #define SM501_ARBTRTN_CONTROL           (0x000014)
133 
134 /* command list */
135 #define SM501_COMMAND_LIST_STATUS       (0x000024)
136 
137 /* interrupt debug */
138 #define SM501_RAW_IRQ_STATUS            (0x000028)
139 #define SM501_RAW_IRQ_CLEAR             (0x000028)
140 #define SM501_IRQ_STATUS                (0x00002C)
141 #define SM501_IRQ_MASK                  (0x000030)
142 #define SM501_DEBUG_CONTROL             (0x000034)
143 
144 /* power management */
145 #define SM501_POWERMODE_P2X_SRC         (1 << 29)
146 #define SM501_POWERMODE_V2X_SRC         (1 << 20)
147 #define SM501_POWERMODE_M_SRC           (1 << 12)
148 #define SM501_POWERMODE_M1_SRC          (1 << 4)
149 
150 #define SM501_CURRENT_GATE              (0x000038)
151 #define SM501_CURRENT_CLOCK             (0x00003C)
152 #define SM501_POWER_MODE_0_GATE         (0x000040)
153 #define SM501_POWER_MODE_0_CLOCK        (0x000044)
154 #define SM501_POWER_MODE_1_GATE         (0x000048)
155 #define SM501_POWER_MODE_1_CLOCK        (0x00004C)
156 #define SM501_SLEEP_MODE_GATE           (0x000050)
157 #define SM501_POWER_MODE_CONTROL        (0x000054)
158 
159 /* power gates for units within the 501 */
160 #define SM501_GATE_HOST                 (0)
161 #define SM501_GATE_MEMORY               (1)
162 #define SM501_GATE_DISPLAY              (2)
163 #define SM501_GATE_2D_ENGINE            (3)
164 #define SM501_GATE_CSC                  (4)
165 #define SM501_GATE_ZVPORT               (5)
166 #define SM501_GATE_GPIO                 (6)
167 #define SM501_GATE_UART0                (7)
168 #define SM501_GATE_UART1                (8)
169 #define SM501_GATE_SSP                  (10)
170 #define SM501_GATE_USB_HOST             (11)
171 #define SM501_GATE_USB_GADGET           (12)
172 #define SM501_GATE_UCONTROLLER          (17)
173 #define SM501_GATE_AC97                 (18)
174 
175 /* panel clock */
176 #define SM501_CLOCK_P2XCLK              (24)
177 /* crt clock */
178 #define SM501_CLOCK_V2XCLK              (16)
179 /* main clock */
180 #define SM501_CLOCK_MCLK                (8)
181 /* SDRAM controller clock */
182 #define SM501_CLOCK_M1XCLK              (0)
183 
184 /* config 2 */
185 #define SM501_PCI_MASTER_BASE           (0x000058)
186 #define SM501_ENDIAN_CONTROL            (0x00005C)
187 #define SM501_DEVICEID                  (0x000060)
188 /* 0x050100A0 */
189 
190 #define SM501_DEVICEID_SM501            (0x05010000)
191 #define SM501_DEVICEID_IDMASK           (0xffff0000)
192 #define SM501_DEVICEID_REVMASK          (0x000000ff)
193 
194 #define SM501_PLLCLOCK_COUNT            (0x000064)
195 #define SM501_MISC_TIMING               (0x000068)
196 #define SM501_CURRENT_SDRAM_CLOCK       (0x00006C)
197 
198 #define SM501_PROGRAMMABLE_PLL_CONTROL  (0x000074)
199 
200 /* GPIO base */
201 #define SM501_GPIO                      (0x010000)
202 #define SM501_GPIO_DATA_LOW             (0x00)
203 #define SM501_GPIO_DATA_HIGH            (0x04)
204 #define SM501_GPIO_DDR_LOW              (0x08)
205 #define SM501_GPIO_DDR_HIGH             (0x0C)
206 #define SM501_GPIO_IRQ_SETUP            (0x10)
207 #define SM501_GPIO_IRQ_STATUS           (0x14)
208 #define SM501_GPIO_IRQ_RESET            (0x14)
209 
210 /* I2C controller base */
211 #define SM501_I2C                       (0x010040)
212 #define SM501_I2C_BYTE_COUNT            (0x00)
213 #define SM501_I2C_CONTROL               (0x01)
214 #define SM501_I2C_STATUS                (0x02)
215 #define SM501_I2C_RESET                 (0x02)
216 #define SM501_I2C_SLAVE_ADDRESS         (0x03)
217 #define SM501_I2C_DATA                  (0x04)
218 
219 /* SSP base */
220 #define SM501_SSP                       (0x020000)
221 
222 /* Uart 0 base */
223 #define SM501_UART0                     (0x030000)
224 
225 /* Uart 1 base */
226 #define SM501_UART1                     (0x030020)
227 
228 /* USB host port base */
229 #define SM501_USB_HOST                  (0x040000)
230 
231 /* USB slave/gadget base */
232 #define SM501_USB_GADGET                (0x060000)
233 
234 /* USB slave/gadget data port base */
235 #define SM501_USB_GADGET_DATA           (0x070000)
236 
237 /* Display controller/video engine base */
238 #define SM501_DC                        (0x080000)
239 
240 /* common defines for the SM501 address registers */
241 #define SM501_ADDR_FLIP                 (1 << 31)
242 #define SM501_ADDR_EXT                  (1 << 27)
243 #define SM501_ADDR_CS1                  (1 << 26)
244 #define SM501_ADDR_MASK                 (0x3f << 26)
245 
246 #define SM501_FIFO_MASK                 (0x3 << 16)
247 #define SM501_FIFO_1                    (0x0 << 16)
248 #define SM501_FIFO_3                    (0x1 << 16)
249 #define SM501_FIFO_7                    (0x2 << 16)
250 #define SM501_FIFO_11                   (0x3 << 16)
251 
252 /* common registers for panel and the crt */
253 #define SM501_OFF_DC_H_TOT              (0x000)
254 #define SM501_OFF_DC_V_TOT              (0x008)
255 #define SM501_OFF_DC_H_SYNC             (0x004)
256 #define SM501_OFF_DC_V_SYNC             (0x00C)
257 
258 #define SM501_DC_PANEL_CONTROL          (0x000)
259 
260 #define SM501_DC_PANEL_CONTROL_FPEN     (1 << 27)
261 #define SM501_DC_PANEL_CONTROL_BIAS     (1 << 26)
262 #define SM501_DC_PANEL_CONTROL_DATA     (1 << 25)
263 #define SM501_DC_PANEL_CONTROL_VDD      (1 << 24)
264 #define SM501_DC_PANEL_CONTROL_DP       (1 << 23)
265 
266 #define SM501_DC_PANEL_CONTROL_TFT_888  (0 << 21)
267 #define SM501_DC_PANEL_CONTROL_TFT_333  (1 << 21)
268 #define SM501_DC_PANEL_CONTROL_TFT_444  (2 << 21)
269 
270 #define SM501_DC_PANEL_CONTROL_DE       (1 << 20)
271 
272 #define SM501_DC_PANEL_CONTROL_LCD_TFT  (0 << 18)
273 #define SM501_DC_PANEL_CONTROL_LCD_STN8 (1 << 18)
274 #define SM501_DC_PANEL_CONTROL_LCD_STN12 (2 << 18)
275 
276 #define SM501_DC_PANEL_CONTROL_CP       (1 << 14)
277 #define SM501_DC_PANEL_CONTROL_VSP      (1 << 13)
278 #define SM501_DC_PANEL_CONTROL_HSP      (1 << 12)
279 #define SM501_DC_PANEL_CONTROL_CK       (1 << 9)
280 #define SM501_DC_PANEL_CONTROL_TE       (1 << 8)
281 #define SM501_DC_PANEL_CONTROL_VPD      (1 << 7)
282 #define SM501_DC_PANEL_CONTROL_VP       (1 << 6)
283 #define SM501_DC_PANEL_CONTROL_HPD      (1 << 5)
284 #define SM501_DC_PANEL_CONTROL_HP       (1 << 4)
285 #define SM501_DC_PANEL_CONTROL_GAMMA    (1 << 3)
286 #define SM501_DC_PANEL_CONTROL_EN       (1 << 2)
287 
288 #define SM501_DC_PANEL_CONTROL_8BPP     (0 << 0)
289 #define SM501_DC_PANEL_CONTROL_16BPP    (1 << 0)
290 #define SM501_DC_PANEL_CONTROL_32BPP    (2 << 0)
291 
292 
293 #define SM501_DC_PANEL_PANNING_CONTROL  (0x004)
294 #define SM501_DC_PANEL_COLOR_KEY        (0x008)
295 #define SM501_DC_PANEL_FB_ADDR          (0x00C)
296 #define SM501_DC_PANEL_FB_OFFSET        (0x010)
297 #define SM501_DC_PANEL_FB_WIDTH         (0x014)
298 #define SM501_DC_PANEL_FB_HEIGHT        (0x018)
299 #define SM501_DC_PANEL_TL_LOC           (0x01C)
300 #define SM501_DC_PANEL_BR_LOC           (0x020)
301 #define SM501_DC_PANEL_H_TOT            (0x024)
302 #define SM501_DC_PANEL_H_SYNC           (0x028)
303 #define SM501_DC_PANEL_V_TOT            (0x02C)
304 #define SM501_DC_PANEL_V_SYNC           (0x030)
305 #define SM501_DC_PANEL_CUR_LINE         (0x034)
306 
307 #define SM501_DC_VIDEO_CONTROL          (0x040)
308 #define SM501_DC_VIDEO_FB0_ADDR         (0x044)
309 #define SM501_DC_VIDEO_FB_WIDTH         (0x048)
310 #define SM501_DC_VIDEO_FB0_LAST_ADDR    (0x04C)
311 #define SM501_DC_VIDEO_TL_LOC           (0x050)
312 #define SM501_DC_VIDEO_BR_LOC           (0x054)
313 #define SM501_DC_VIDEO_SCALE            (0x058)
314 #define SM501_DC_VIDEO_INIT_SCALE       (0x05C)
315 #define SM501_DC_VIDEO_YUV_CONSTANTS    (0x060)
316 #define SM501_DC_VIDEO_FB1_ADDR         (0x064)
317 #define SM501_DC_VIDEO_FB1_LAST_ADDR    (0x068)
318 
319 #define SM501_DC_VIDEO_ALPHA_CONTROL    (0x080)
320 #define SM501_DC_VIDEO_ALPHA_FB_ADDR    (0x084)
321 #define SM501_DC_VIDEO_ALPHA_FB_OFFSET  (0x088)
322 #define SM501_DC_VIDEO_ALPHA_FB_LAST_ADDR (0x08C)
323 #define SM501_DC_VIDEO_ALPHA_TL_LOC     (0x090)
324 #define SM501_DC_VIDEO_ALPHA_BR_LOC     (0x094)
325 #define SM501_DC_VIDEO_ALPHA_SCALE      (0x098)
326 #define SM501_DC_VIDEO_ALPHA_INIT_SCALE (0x09C)
327 #define SM501_DC_VIDEO_ALPHA_CHROMA_KEY (0x0A0)
328 #define SM501_DC_VIDEO_ALPHA_COLOR_LOOKUP (0x0A4)
329 
330 #define SM501_DC_PANEL_HWC_BASE         (0x0F0)
331 #define SM501_DC_PANEL_HWC_ADDR         (0x0F0)
332 #define SM501_DC_PANEL_HWC_LOC          (0x0F4)
333 #define SM501_DC_PANEL_HWC_COLOR_1_2    (0x0F8)
334 #define SM501_DC_PANEL_HWC_COLOR_3      (0x0FC)
335 
336 #define SM501_HWC_EN                    (1 << 31)
337 
338 #define SM501_OFF_HWC_ADDR              (0x00)
339 #define SM501_OFF_HWC_LOC               (0x04)
340 #define SM501_OFF_HWC_COLOR_1_2         (0x08)
341 #define SM501_OFF_HWC_COLOR_3           (0x0C)
342 
343 #define SM501_DC_ALPHA_CONTROL          (0x100)
344 #define SM501_DC_ALPHA_FB_ADDR          (0x104)
345 #define SM501_DC_ALPHA_FB_OFFSET        (0x108)
346 #define SM501_DC_ALPHA_TL_LOC           (0x10C)
347 #define SM501_DC_ALPHA_BR_LOC           (0x110)
348 #define SM501_DC_ALPHA_CHROMA_KEY       (0x114)
349 #define SM501_DC_ALPHA_COLOR_LOOKUP     (0x118)
350 
351 #define SM501_DC_CRT_CONTROL            (0x200)
352 
353 #define SM501_DC_CRT_CONTROL_TVP        (1 << 15)
354 #define SM501_DC_CRT_CONTROL_CP         (1 << 14)
355 #define SM501_DC_CRT_CONTROL_VSP        (1 << 13)
356 #define SM501_DC_CRT_CONTROL_HSP        (1 << 12)
357 #define SM501_DC_CRT_CONTROL_VS         (1 << 11)
358 #define SM501_DC_CRT_CONTROL_BLANK      (1 << 10)
359 #define SM501_DC_CRT_CONTROL_SEL        (1 << 9)
360 #define SM501_DC_CRT_CONTROL_TE         (1 << 8)
361 #define SM501_DC_CRT_CONTROL_PIXEL_MASK (0xF << 4)
362 #define SM501_DC_CRT_CONTROL_GAMMA      (1 << 3)
363 #define SM501_DC_CRT_CONTROL_ENABLE     (1 << 2)
364 
365 #define SM501_DC_CRT_CONTROL_8BPP       (0 << 0)
366 #define SM501_DC_CRT_CONTROL_16BPP      (1 << 0)
367 #define SM501_DC_CRT_CONTROL_32BPP      (2 << 0)
368 
369 #define SM501_DC_CRT_FB_ADDR            (0x204)
370 #define SM501_DC_CRT_FB_OFFSET          (0x208)
371 #define SM501_DC_CRT_H_TOT              (0x20C)
372 #define SM501_DC_CRT_H_SYNC             (0x210)
373 #define SM501_DC_CRT_V_TOT              (0x214)
374 #define SM501_DC_CRT_V_SYNC             (0x218)
375 #define SM501_DC_CRT_SIGNATURE_ANALYZER (0x21C)
376 #define SM501_DC_CRT_CUR_LINE           (0x220)
377 #define SM501_DC_CRT_MONITOR_DETECT     (0x224)
378 
379 #define SM501_DC_CRT_HWC_BASE           (0x230)
380 #define SM501_DC_CRT_HWC_ADDR           (0x230)
381 #define SM501_DC_CRT_HWC_LOC            (0x234)
382 #define SM501_DC_CRT_HWC_COLOR_1_2      (0x238)
383 #define SM501_DC_CRT_HWC_COLOR_3        (0x23C)
384 
385 #define SM501_DC_PANEL_PALETTE          (0x400)
386 
387 #define SM501_DC_VIDEO_PALETTE          (0x800)
388 
389 #define SM501_DC_CRT_PALETTE            (0xC00)
390 
391 /* Zoom Video port base */
392 #define SM501_ZVPORT                    (0x090000)
393 
394 /* AC97/I2S base */
395 #define SM501_AC97                      (0x0A0000)
396 
397 /* 8051 micro controller base */
398 #define SM501_UCONTROLLER               (0x0B0000)
399 
400 /* 8051 micro controller SRAM base */
401 #define SM501_UCONTROLLER_SRAM          (0x0C0000)
402 
403 /* DMA base */
404 #define SM501_DMA                       (0x0D0000)
405 
406 /* 2d engine base */
407 #define SM501_2D_ENGINE                 (0x100000)
408 #define SM501_2D_SOURCE                 (0x00)
409 #define SM501_2D_DESTINATION            (0x04)
410 #define SM501_2D_DIMENSION              (0x08)
411 #define SM501_2D_CONTROL                (0x0C)
412 #define SM501_2D_PITCH                  (0x10)
413 #define SM501_2D_FOREGROUND             (0x14)
414 #define SM501_2D_BACKGROUND             (0x18)
415 #define SM501_2D_STRETCH                (0x1C)
416 #define SM501_2D_COLOR_COMPARE          (0x20)
417 #define SM501_2D_COLOR_COMPARE_MASK     (0x24)
418 #define SM501_2D_MASK                   (0x28)
419 #define SM501_2D_CLIP_TL                (0x2C)
420 #define SM501_2D_CLIP_BR                (0x30)
421 #define SM501_2D_MONO_PATTERN_LOW       (0x34)
422 #define SM501_2D_MONO_PATTERN_HIGH      (0x38)
423 #define SM501_2D_WINDOW_WIDTH           (0x3C)
424 #define SM501_2D_SOURCE_BASE            (0x40)
425 #define SM501_2D_DESTINATION_BASE       (0x44)
426 #define SM501_2D_ALPHA                  (0x48)
427 #define SM501_2D_WRAP                   (0x4C)
428 #define SM501_2D_STATUS                 (0x50)
429 
430 #define SM501_CSC_Y_SOURCE_BASE         (0xC8)
431 #define SM501_CSC_CONSTANTS             (0xCC)
432 #define SM501_CSC_Y_SOURCE_X            (0xD0)
433 #define SM501_CSC_Y_SOURCE_Y            (0xD4)
434 #define SM501_CSC_U_SOURCE_BASE         (0xD8)
435 #define SM501_CSC_V_SOURCE_BASE         (0xDC)
436 #define SM501_CSC_SOURCE_DIMENSION      (0xE0)
437 #define SM501_CSC_SOURCE_PITCH          (0xE4)
438 #define SM501_CSC_DESTINATION           (0xE8)
439 #define SM501_CSC_DESTINATION_DIMENSION (0xEC)
440 #define SM501_CSC_DESTINATION_PITCH     (0xF0)
441 #define SM501_CSC_SCALE_FACTOR          (0xF4)
442 #define SM501_CSC_DESTINATION_BASE      (0xF8)
443 #define SM501_CSC_CONTROL               (0xFC)
444 
445 /* 2d engine data port base */
446 #define SM501_2D_ENGINE_DATA            (0x110000)
447 
448 /* end of register definitions */
449 
450 #define SM501_HWC_WIDTH                       (64)
451 #define SM501_HWC_HEIGHT                      (64)
452 
453 /* SM501 local memory size taken from "linux/drivers/mfd/sm501.c" */
454 static const uint32_t sm501_mem_local_size[] = {
455     [0] = 4 * MiB,
456     [1] = 8 * MiB,
457     [2] = 16 * MiB,
458     [3] = 32 * MiB,
459     [4] = 64 * MiB,
460     [5] = 2 * MiB,
461 };
462 #define get_local_mem_size(s) sm501_mem_local_size[(s)->local_mem_size_index]
463 
464 typedef struct SM501State {
465     /* graphic console status */
466     QemuConsole *con;
467 
468     /* status & internal resources */
469     uint32_t local_mem_size_index;
470     uint8_t *local_mem;
471     MemoryRegion local_mem_region;
472     MemoryRegion mmio_region;
473     MemoryRegion system_config_region;
474     MemoryRegion disp_ctrl_region;
475     MemoryRegion twoD_engine_region;
476     uint32_t last_width;
477     uint32_t last_height;
478 
479     /* mmio registers */
480     uint32_t system_control;
481     uint32_t misc_control;
482     uint32_t gpio_31_0_control;
483     uint32_t gpio_63_32_control;
484     uint32_t dram_control;
485     uint32_t arbitration_control;
486     uint32_t irq_mask;
487     uint32_t misc_timing;
488     uint32_t power_mode_control;
489 
490     uint32_t uart0_ier;
491     uint32_t uart0_lcr;
492     uint32_t uart0_mcr;
493     uint32_t uart0_scr;
494 
495     uint8_t dc_palette[DC_PALETTE_ENTRIES];
496 
497     uint32_t dc_panel_control;
498     uint32_t dc_panel_panning_control;
499     uint32_t dc_panel_fb_addr;
500     uint32_t dc_panel_fb_offset;
501     uint32_t dc_panel_fb_width;
502     uint32_t dc_panel_fb_height;
503     uint32_t dc_panel_tl_location;
504     uint32_t dc_panel_br_location;
505     uint32_t dc_panel_h_total;
506     uint32_t dc_panel_h_sync;
507     uint32_t dc_panel_v_total;
508     uint32_t dc_panel_v_sync;
509 
510     uint32_t dc_panel_hwc_addr;
511     uint32_t dc_panel_hwc_location;
512     uint32_t dc_panel_hwc_color_1_2;
513     uint32_t dc_panel_hwc_color_3;
514 
515     uint32_t dc_video_control;
516 
517     uint32_t dc_crt_control;
518     uint32_t dc_crt_fb_addr;
519     uint32_t dc_crt_fb_offset;
520     uint32_t dc_crt_h_total;
521     uint32_t dc_crt_h_sync;
522     uint32_t dc_crt_v_total;
523     uint32_t dc_crt_v_sync;
524 
525     uint32_t dc_crt_hwc_addr;
526     uint32_t dc_crt_hwc_location;
527     uint32_t dc_crt_hwc_color_1_2;
528     uint32_t dc_crt_hwc_color_3;
529 
530     uint32_t twoD_source;
531     uint32_t twoD_destination;
532     uint32_t twoD_dimension;
533     uint32_t twoD_control;
534     uint32_t twoD_pitch;
535     uint32_t twoD_foreground;
536     uint32_t twoD_background;
537     uint32_t twoD_stretch;
538     uint32_t twoD_color_compare;
539     uint32_t twoD_color_compare_mask;
540     uint32_t twoD_mask;
541     uint32_t twoD_clip_tl;
542     uint32_t twoD_clip_br;
543     uint32_t twoD_mono_pattern_low;
544     uint32_t twoD_mono_pattern_high;
545     uint32_t twoD_window_width;
546     uint32_t twoD_source_base;
547     uint32_t twoD_destination_base;
548     uint32_t twoD_alpha;
549     uint32_t twoD_wrap;
550 } SM501State;
551 
552 static uint32_t get_local_mem_size_index(uint32_t size)
553 {
554     uint32_t norm_size = 0;
555     int i, index = 0;
556 
557     for (i = 0; i < ARRAY_SIZE(sm501_mem_local_size); i++) {
558         uint32_t new_size = sm501_mem_local_size[i];
559         if (new_size >= size) {
560             if (norm_size == 0 || norm_size > new_size) {
561                 norm_size = new_size;
562                 index = i;
563             }
564         }
565     }
566 
567     return index;
568 }
569 
570 static inline int get_width(SM501State *s, int crt)
571 {
572     int width = crt ? s->dc_crt_h_total : s->dc_panel_h_total;
573     return (width & 0x00000FFF) + 1;
574 }
575 
576 static inline int get_height(SM501State *s, int crt)
577 {
578     int height = crt ? s->dc_crt_v_total : s->dc_panel_v_total;
579     return (height & 0x00000FFF) + 1;
580 }
581 
582 static inline int get_bpp(SM501State *s, int crt)
583 {
584     int bpp = crt ? s->dc_crt_control : s->dc_panel_control;
585     return 1 << (bpp & 3);
586 }
587 
588 /**
589  * Check the availability of hardware cursor.
590  * @param crt  0 for PANEL, 1 for CRT.
591  */
592 static inline int is_hwc_enabled(SM501State *state, int crt)
593 {
594     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
595     return addr & SM501_HWC_EN;
596 }
597 
598 /**
599  * Get the address which holds cursor pattern data.
600  * @param crt  0 for PANEL, 1 for CRT.
601  */
602 static inline uint8_t *get_hwc_address(SM501State *state, int crt)
603 {
604     uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;
605     return state->local_mem + (addr & 0x03FFFFF0);
606 }
607 
608 /**
609  * Get the cursor position in y coordinate.
610  * @param crt  0 for PANEL, 1 for CRT.
611  */
612 static inline uint32_t get_hwc_y(SM501State *state, int crt)
613 {
614     uint32_t location = crt ? state->dc_crt_hwc_location
615                             : state->dc_panel_hwc_location;
616     return (location & 0x07FF0000) >> 16;
617 }
618 
619 /**
620  * Get the cursor position in x coordinate.
621  * @param crt  0 for PANEL, 1 for CRT.
622  */
623 static inline uint32_t get_hwc_x(SM501State *state, int crt)
624 {
625     uint32_t location = crt ? state->dc_crt_hwc_location
626                             : state->dc_panel_hwc_location;
627     return location & 0x000007FF;
628 }
629 
630 /**
631  * Get the hardware cursor palette.
632  * @param crt  0 for PANEL, 1 for CRT.
633  * @param palette  pointer to a [3 * 3] array to store color values in
634  */
635 static inline void get_hwc_palette(SM501State *state, int crt, uint8_t *palette)
636 {
637     int i;
638     uint32_t color_reg;
639     uint16_t rgb565;
640 
641     for (i = 0; i < 3; i++) {
642         if (i + 1 == 3) {
643             color_reg = crt ? state->dc_crt_hwc_color_3
644                             : state->dc_panel_hwc_color_3;
645         } else {
646             color_reg = crt ? state->dc_crt_hwc_color_1_2
647                             : state->dc_panel_hwc_color_1_2;
648         }
649 
650         if (i + 1 == 2) {
651             rgb565 = (color_reg >> 16) & 0xFFFF;
652         } else {
653             rgb565 = color_reg & 0xFFFF;
654         }
655         palette[i * 3 + 0] = ((rgb565 >> 11) * 527 + 23) >> 6; /* r */
656         palette[i * 3 + 1] = (((rgb565 >> 5) & 0x3f) * 259 + 33) >> 6; /* g */
657         palette[i * 3 + 2] = ((rgb565 & 0x1f) * 527 + 23) >> 6; /* b */
658     }
659 }
660 
661 static inline void hwc_invalidate(SM501State *s, int crt)
662 {
663     int w = get_width(s, crt);
664     int h = get_height(s, crt);
665     int bpp = get_bpp(s, crt);
666     int start = get_hwc_y(s, crt);
667     int end = MIN(h, start + SM501_HWC_HEIGHT) + 1;
668 
669     start *= w * bpp;
670     end *= w * bpp;
671 
672     memory_region_set_dirty(&s->local_mem_region, start, end - start);
673 }
674 
675 static void sm501_2d_operation(SM501State *s)
676 {
677     /* obtain operation parameters */
678     int operation = (s->twoD_control >> 16) & 0x1f;
679     int rtl = s->twoD_control & 0x8000000;
680     int src_x = (s->twoD_source >> 16) & 0x01FFF;
681     int src_y = s->twoD_source & 0xFFFF;
682     int dst_x = (s->twoD_destination >> 16) & 0x01FFF;
683     int dst_y = s->twoD_destination & 0xFFFF;
684     int operation_width = (s->twoD_dimension >> 16) & 0x1FFF;
685     int operation_height = s->twoD_dimension & 0xFFFF;
686     uint32_t color = s->twoD_foreground;
687     int format_flags = (s->twoD_stretch >> 20) & 0x3;
688     int addressing = (s->twoD_stretch >> 16) & 0xF;
689 
690     /* get frame buffer info */
691     uint8_t *src = s->local_mem + (s->twoD_source_base & 0x03FFFFFF);
692     uint8_t *dst = s->local_mem + (s->twoD_destination_base & 0x03FFFFFF);
693     int src_width = (s->dc_crt_h_total & 0x00000FFF) + 1;
694     int dst_width = (s->dc_crt_h_total & 0x00000FFF) + 1;
695 
696     if (addressing != 0x0) {
697         printf("%s: only XY addressing is supported.\n", __func__);
698         abort();
699     }
700 
701     if ((s->twoD_source_base & 0x08000000) ||
702         (s->twoD_destination_base & 0x08000000)) {
703         printf("%s: only local memory is supported.\n", __func__);
704         abort();
705     }
706 
707     switch (operation) {
708     case 0x00: /* copy area */
709 #define COPY_AREA(_bpp, _pixel_type, rtl) {                                   \
710         int y, x, index_d, index_s;                                           \
711         for (y = 0; y < operation_height; y++) {                              \
712             for (x = 0; x < operation_width; x++) {                           \
713                 if (rtl) {                                                    \
714                     index_s = ((src_y - y) * src_width + src_x - x) * _bpp;   \
715                     index_d = ((dst_y - y) * dst_width + dst_x - x) * _bpp;   \
716                 } else {                                                      \
717                     index_s = ((src_y + y) * src_width + src_x + x) * _bpp;   \
718                     index_d = ((dst_y + y) * dst_width + dst_x + x) * _bpp;   \
719                 }                                                             \
720                 *(_pixel_type *)&dst[index_d] = *(_pixel_type *)&src[index_s];\
721             }                                                                 \
722         }                                                                     \
723     }
724         switch (format_flags) {
725         case 0:
726             COPY_AREA(1, uint8_t, rtl);
727             break;
728         case 1:
729             COPY_AREA(2, uint16_t, rtl);
730             break;
731         case 2:
732             COPY_AREA(4, uint32_t, rtl);
733             break;
734         }
735         break;
736 
737     case 0x01: /* fill rectangle */
738 #define FILL_RECT(_bpp, _pixel_type) {                                      \
739         int y, x;                                                           \
740         for (y = 0; y < operation_height; y++) {                            \
741             for (x = 0; x < operation_width; x++) {                         \
742                 int index = ((dst_y + y) * dst_width + dst_x + x) * _bpp;   \
743                 *(_pixel_type *)&dst[index] = (_pixel_type)color;           \
744             }                                                               \
745         }                                                                   \
746     }
747 
748         switch (format_flags) {
749         case 0:
750             FILL_RECT(1, uint8_t);
751             break;
752         case 1:
753             FILL_RECT(2, uint16_t);
754             break;
755         case 2:
756             FILL_RECT(4, uint32_t);
757             break;
758         }
759         break;
760 
761     default:
762         printf("non-implemented SM501 2D operation. %d\n", operation);
763         abort();
764         break;
765     }
766 }
767 
768 static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
769                                          unsigned size)
770 {
771     SM501State *s = (SM501State *)opaque;
772     uint32_t ret = 0;
773     SM501_DPRINTF("sm501 system config regs : read addr=%x\n", (int)addr);
774 
775     switch (addr) {
776     case SM501_SYSTEM_CONTROL:
777         ret = s->system_control;
778         break;
779     case SM501_MISC_CONTROL:
780         ret = s->misc_control;
781         break;
782     case SM501_GPIO31_0_CONTROL:
783         ret = s->gpio_31_0_control;
784         break;
785     case SM501_GPIO63_32_CONTROL:
786         ret = s->gpio_63_32_control;
787         break;
788     case SM501_DEVICEID:
789         ret = 0x050100A0;
790         break;
791     case SM501_DRAM_CONTROL:
792         ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
793         break;
794     case SM501_ARBTRTN_CONTROL:
795         ret = s->arbitration_control;
796         break;
797     case SM501_COMMAND_LIST_STATUS:
798         ret = 0x00180002; /* FIFOs are empty, everything idle */
799         break;
800     case SM501_IRQ_MASK:
801         ret = s->irq_mask;
802         break;
803     case SM501_MISC_TIMING:
804         /* TODO : simulate gate control */
805         ret = s->misc_timing;
806         break;
807     case SM501_CURRENT_GATE:
808         /* TODO : simulate gate control */
809         ret = 0x00021807;
810         break;
811     case SM501_CURRENT_CLOCK:
812         ret = 0x2A1A0A09;
813         break;
814     case SM501_POWER_MODE_CONTROL:
815         ret = s->power_mode_control;
816         break;
817     case SM501_ENDIAN_CONTROL:
818         ret = 0; /* Only default little endian mode is supported */
819         break;
820 
821     default:
822         printf("sm501 system config : not implemented register read."
823                " addr=%x\n", (int)addr);
824         abort();
825     }
826 
827     return ret;
828 }
829 
830 static void sm501_system_config_write(void *opaque, hwaddr addr,
831                                       uint64_t value, unsigned size)
832 {
833     SM501State *s = (SM501State *)opaque;
834     SM501_DPRINTF("sm501 system config regs : write addr=%x, val=%x\n",
835                   (uint32_t)addr, (uint32_t)value);
836 
837     switch (addr) {
838     case SM501_SYSTEM_CONTROL:
839         s->system_control &= 0x10DB0000;
840         s->system_control |= value & 0xEF00B8F7;
841         break;
842     case SM501_MISC_CONTROL:
843         s->misc_control &= 0xEF;
844         s->misc_control |= value & 0xFF7FFF10;
845         break;
846     case SM501_GPIO31_0_CONTROL:
847         s->gpio_31_0_control = value;
848         break;
849     case SM501_GPIO63_32_CONTROL:
850         s->gpio_63_32_control = value & 0xFF80FFFF;
851         break;
852     case SM501_DRAM_CONTROL:
853         s->local_mem_size_index = (value >> 13) & 0x7;
854         /* TODO : check validity of size change */
855         s->dram_control &= 0x80000000;
856         s->dram_control |= value & 0x7FFFFFC3;
857         break;
858     case SM501_ARBTRTN_CONTROL:
859         s->arbitration_control = value & 0x37777777;
860         break;
861     case SM501_IRQ_MASK:
862         s->irq_mask = value & 0xFFDF3F5F;
863         break;
864     case SM501_MISC_TIMING:
865         s->misc_timing = value & 0xF31F1FFF;
866         break;
867     case SM501_POWER_MODE_0_GATE:
868     case SM501_POWER_MODE_1_GATE:
869     case SM501_POWER_MODE_0_CLOCK:
870     case SM501_POWER_MODE_1_CLOCK:
871         /* TODO : simulate gate & clock control */
872         break;
873     case SM501_POWER_MODE_CONTROL:
874         s->power_mode_control = value & 0x00000003;
875         break;
876     case SM501_ENDIAN_CONTROL:
877         if (value & 0x00000001) {
878             printf("sm501 system config : big endian mode not implemented.\n");
879             abort();
880         }
881         break;
882 
883     default:
884         printf("sm501 system config : not implemented register write."
885                " addr=%x, val=%x\n", (int)addr, (uint32_t)value);
886         abort();
887     }
888 }
889 
890 static const MemoryRegionOps sm501_system_config_ops = {
891     .read = sm501_system_config_read,
892     .write = sm501_system_config_write,
893     .valid = {
894         .min_access_size = 4,
895         .max_access_size = 4,
896     },
897     .endianness = DEVICE_LITTLE_ENDIAN,
898 };
899 
900 static uint32_t sm501_palette_read(void *opaque, hwaddr addr)
901 {
902     SM501State *s = (SM501State *)opaque;
903     SM501_DPRINTF("sm501 palette read addr=%x\n", (int)addr);
904 
905     /* TODO : consider BYTE/WORD access */
906     /* TODO : consider endian */
907 
908     assert(range_covers_byte(0, 0x400 * 3, addr));
909     return *(uint32_t *)&s->dc_palette[addr];
910 }
911 
912 static void sm501_palette_write(void *opaque, hwaddr addr,
913                                 uint32_t value)
914 {
915     SM501State *s = (SM501State *)opaque;
916     SM501_DPRINTF("sm501 palette write addr=%x, val=%x\n",
917                   (int)addr, value);
918 
919     /* TODO : consider BYTE/WORD access */
920     /* TODO : consider endian */
921 
922     assert(range_covers_byte(0, 0x400 * 3, addr));
923     *(uint32_t *)&s->dc_palette[addr] = value;
924 }
925 
926 static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr addr,
927                                      unsigned size)
928 {
929     SM501State *s = (SM501State *)opaque;
930     uint32_t ret = 0;
931     SM501_DPRINTF("sm501 disp ctrl regs : read addr=%x\n", (int)addr);
932 
933     switch (addr) {
934 
935     case SM501_DC_PANEL_CONTROL:
936         ret = s->dc_panel_control;
937         break;
938     case SM501_DC_PANEL_PANNING_CONTROL:
939         ret = s->dc_panel_panning_control;
940         break;
941     case SM501_DC_PANEL_COLOR_KEY:
942         /* Not implemented yet */
943         break;
944     case SM501_DC_PANEL_FB_ADDR:
945         ret = s->dc_panel_fb_addr;
946         break;
947     case SM501_DC_PANEL_FB_OFFSET:
948         ret = s->dc_panel_fb_offset;
949         break;
950     case SM501_DC_PANEL_FB_WIDTH:
951         ret = s->dc_panel_fb_width;
952         break;
953     case SM501_DC_PANEL_FB_HEIGHT:
954         ret = s->dc_panel_fb_height;
955         break;
956     case SM501_DC_PANEL_TL_LOC:
957         ret = s->dc_panel_tl_location;
958         break;
959     case SM501_DC_PANEL_BR_LOC:
960         ret = s->dc_panel_br_location;
961         break;
962 
963     case SM501_DC_PANEL_H_TOT:
964         ret = s->dc_panel_h_total;
965         break;
966     case SM501_DC_PANEL_H_SYNC:
967         ret = s->dc_panel_h_sync;
968         break;
969     case SM501_DC_PANEL_V_TOT:
970         ret = s->dc_panel_v_total;
971         break;
972     case SM501_DC_PANEL_V_SYNC:
973         ret = s->dc_panel_v_sync;
974         break;
975 
976     case SM501_DC_PANEL_HWC_ADDR:
977         ret = s->dc_panel_hwc_addr;
978         break;
979     case SM501_DC_PANEL_HWC_LOC:
980         ret = s->dc_panel_hwc_location;
981         break;
982     case SM501_DC_PANEL_HWC_COLOR_1_2:
983         ret = s->dc_panel_hwc_color_1_2;
984         break;
985     case SM501_DC_PANEL_HWC_COLOR_3:
986         ret = s->dc_panel_hwc_color_3;
987         break;
988 
989     case SM501_DC_VIDEO_CONTROL:
990         ret = s->dc_video_control;
991         break;
992 
993     case SM501_DC_CRT_CONTROL:
994         ret = s->dc_crt_control;
995         break;
996     case SM501_DC_CRT_FB_ADDR:
997         ret = s->dc_crt_fb_addr;
998         break;
999     case SM501_DC_CRT_FB_OFFSET:
1000         ret = s->dc_crt_fb_offset;
1001         break;
1002     case SM501_DC_CRT_H_TOT:
1003         ret = s->dc_crt_h_total;
1004         break;
1005     case SM501_DC_CRT_H_SYNC:
1006         ret = s->dc_crt_h_sync;
1007         break;
1008     case SM501_DC_CRT_V_TOT:
1009         ret = s->dc_crt_v_total;
1010         break;
1011     case SM501_DC_CRT_V_SYNC:
1012         ret = s->dc_crt_v_sync;
1013         break;
1014 
1015     case SM501_DC_CRT_HWC_ADDR:
1016         ret = s->dc_crt_hwc_addr;
1017         break;
1018     case SM501_DC_CRT_HWC_LOC:
1019         ret = s->dc_crt_hwc_location;
1020         break;
1021     case SM501_DC_CRT_HWC_COLOR_1_2:
1022         ret = s->dc_crt_hwc_color_1_2;
1023         break;
1024     case SM501_DC_CRT_HWC_COLOR_3:
1025         ret = s->dc_crt_hwc_color_3;
1026         break;
1027 
1028     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1029         ret = sm501_palette_read(opaque, addr - SM501_DC_PANEL_PALETTE);
1030         break;
1031 
1032     default:
1033         printf("sm501 disp ctrl : not implemented register read."
1034                " addr=%x\n", (int)addr);
1035         abort();
1036     }
1037 
1038     return ret;
1039 }
1040 
1041 static void sm501_disp_ctrl_write(void *opaque, hwaddr addr,
1042                                   uint64_t value, unsigned size)
1043 {
1044     SM501State *s = (SM501State *)opaque;
1045     SM501_DPRINTF("sm501 disp ctrl regs : write addr=%x, val=%x\n",
1046                   (unsigned)addr, (unsigned)value);
1047 
1048     switch (addr) {
1049     case SM501_DC_PANEL_CONTROL:
1050         s->dc_panel_control = value & 0x0FFF73FF;
1051         break;
1052     case SM501_DC_PANEL_PANNING_CONTROL:
1053         s->dc_panel_panning_control = value & 0xFF3FFF3F;
1054         break;
1055     case SM501_DC_PANEL_COLOR_KEY:
1056         /* Not implemented yet */
1057         break;
1058     case SM501_DC_PANEL_FB_ADDR:
1059         s->dc_panel_fb_addr = value & 0x8FFFFFF0;
1060         break;
1061     case SM501_DC_PANEL_FB_OFFSET:
1062         s->dc_panel_fb_offset = value & 0x3FF03FF0;
1063         break;
1064     case SM501_DC_PANEL_FB_WIDTH:
1065         s->dc_panel_fb_width = value & 0x0FFF0FFF;
1066         break;
1067     case SM501_DC_PANEL_FB_HEIGHT:
1068         s->dc_panel_fb_height = value & 0x0FFF0FFF;
1069         break;
1070     case SM501_DC_PANEL_TL_LOC:
1071         s->dc_panel_tl_location = value & 0x07FF07FF;
1072         break;
1073     case SM501_DC_PANEL_BR_LOC:
1074         s->dc_panel_br_location = value & 0x07FF07FF;
1075         break;
1076 
1077     case SM501_DC_PANEL_H_TOT:
1078         s->dc_panel_h_total = value & 0x0FFF0FFF;
1079         break;
1080     case SM501_DC_PANEL_H_SYNC:
1081         s->dc_panel_h_sync = value & 0x00FF0FFF;
1082         break;
1083     case SM501_DC_PANEL_V_TOT:
1084         s->dc_panel_v_total = value & 0x0FFF0FFF;
1085         break;
1086     case SM501_DC_PANEL_V_SYNC:
1087         s->dc_panel_v_sync = value & 0x003F0FFF;
1088         break;
1089 
1090     case SM501_DC_PANEL_HWC_ADDR:
1091         value &= 0x8FFFFFF0;
1092         if (value != s->dc_panel_hwc_addr) {
1093             hwc_invalidate(s, 0);
1094             s->dc_panel_hwc_addr = value;
1095         }
1096         break;
1097     case SM501_DC_PANEL_HWC_LOC:
1098         value &= 0x0FFF0FFF;
1099         if (value != s->dc_panel_hwc_location) {
1100             hwc_invalidate(s, 0);
1101             s->dc_panel_hwc_location = value;
1102         }
1103         break;
1104     case SM501_DC_PANEL_HWC_COLOR_1_2:
1105         s->dc_panel_hwc_color_1_2 = value;
1106         break;
1107     case SM501_DC_PANEL_HWC_COLOR_3:
1108         s->dc_panel_hwc_color_3 = value & 0x0000FFFF;
1109         break;
1110 
1111     case SM501_DC_VIDEO_CONTROL:
1112         s->dc_video_control = value & 0x00037FFF;
1113         break;
1114 
1115     case SM501_DC_CRT_CONTROL:
1116         s->dc_crt_control = value & 0x0003FFFF;
1117         break;
1118     case SM501_DC_CRT_FB_ADDR:
1119         s->dc_crt_fb_addr = value & 0x8FFFFFF0;
1120         break;
1121     case SM501_DC_CRT_FB_OFFSET:
1122         s->dc_crt_fb_offset = value & 0x3FF03FF0;
1123         break;
1124     case SM501_DC_CRT_H_TOT:
1125         s->dc_crt_h_total = value & 0x0FFF0FFF;
1126         break;
1127     case SM501_DC_CRT_H_SYNC:
1128         s->dc_crt_h_sync = value & 0x00FF0FFF;
1129         break;
1130     case SM501_DC_CRT_V_TOT:
1131         s->dc_crt_v_total = value & 0x0FFF0FFF;
1132         break;
1133     case SM501_DC_CRT_V_SYNC:
1134         s->dc_crt_v_sync = value & 0x003F0FFF;
1135         break;
1136 
1137     case SM501_DC_CRT_HWC_ADDR:
1138         value &= 0x8FFFFFF0;
1139         if (value != s->dc_crt_hwc_addr) {
1140             hwc_invalidate(s, 1);
1141             s->dc_crt_hwc_addr = value;
1142         }
1143         break;
1144     case SM501_DC_CRT_HWC_LOC:
1145         value &= 0x0FFF0FFF;
1146         if (value != s->dc_crt_hwc_location) {
1147             hwc_invalidate(s, 1);
1148             s->dc_crt_hwc_location = value;
1149         }
1150         break;
1151     case SM501_DC_CRT_HWC_COLOR_1_2:
1152         s->dc_crt_hwc_color_1_2 = value;
1153         break;
1154     case SM501_DC_CRT_HWC_COLOR_3:
1155         s->dc_crt_hwc_color_3 = value & 0x0000FFFF;
1156         break;
1157 
1158     case SM501_DC_PANEL_PALETTE ... SM501_DC_PANEL_PALETTE + 0x400 * 3 - 4:
1159         sm501_palette_write(opaque, addr - SM501_DC_PANEL_PALETTE, value);
1160         break;
1161 
1162     default:
1163         printf("sm501 disp ctrl : not implemented register write."
1164                " addr=%x, val=%x\n", (int)addr, (unsigned)value);
1165         abort();
1166     }
1167 }
1168 
1169 static const MemoryRegionOps sm501_disp_ctrl_ops = {
1170     .read = sm501_disp_ctrl_read,
1171     .write = sm501_disp_ctrl_write,
1172     .valid = {
1173         .min_access_size = 4,
1174         .max_access_size = 4,
1175     },
1176     .endianness = DEVICE_LITTLE_ENDIAN,
1177 };
1178 
1179 static uint64_t sm501_2d_engine_read(void *opaque, hwaddr addr,
1180                                      unsigned size)
1181 {
1182     SM501State *s = (SM501State *)opaque;
1183     uint32_t ret = 0;
1184     SM501_DPRINTF("sm501 2d engine regs : read addr=%x\n", (int)addr);
1185 
1186     switch (addr) {
1187     case SM501_2D_SOURCE:
1188         ret = s->twoD_source;
1189         break;
1190     case SM501_2D_DESTINATION:
1191         ret = s->twoD_destination;
1192         break;
1193     case SM501_2D_DIMENSION:
1194         ret = s->twoD_dimension;
1195         break;
1196     case SM501_2D_CONTROL:
1197         ret = s->twoD_control;
1198         break;
1199     case SM501_2D_PITCH:
1200         ret = s->twoD_pitch;
1201         break;
1202     case SM501_2D_FOREGROUND:
1203         ret = s->twoD_foreground;
1204         break;
1205     case SM501_2D_BACKGROUND:
1206         ret = s->twoD_background;
1207         break;
1208     case SM501_2D_STRETCH:
1209         ret = s->twoD_stretch;
1210         break;
1211     case SM501_2D_COLOR_COMPARE:
1212         ret = s->twoD_color_compare;
1213         break;
1214     case SM501_2D_COLOR_COMPARE_MASK:
1215         ret = s->twoD_color_compare_mask;
1216         break;
1217     case SM501_2D_MASK:
1218         ret = s->twoD_mask;
1219         break;
1220     case SM501_2D_CLIP_TL:
1221         ret = s->twoD_clip_tl;
1222         break;
1223     case SM501_2D_CLIP_BR:
1224         ret = s->twoD_clip_br;
1225         break;
1226     case SM501_2D_MONO_PATTERN_LOW:
1227         ret = s->twoD_mono_pattern_low;
1228         break;
1229     case SM501_2D_MONO_PATTERN_HIGH:
1230         ret = s->twoD_mono_pattern_high;
1231         break;
1232     case SM501_2D_WINDOW_WIDTH:
1233         ret = s->twoD_window_width;
1234         break;
1235     case SM501_2D_SOURCE_BASE:
1236         ret = s->twoD_source_base;
1237         break;
1238     case SM501_2D_DESTINATION_BASE:
1239         ret = s->twoD_destination_base;
1240         break;
1241     case SM501_2D_ALPHA:
1242         ret = s->twoD_alpha;
1243         break;
1244     case SM501_2D_WRAP:
1245         ret = s->twoD_wrap;
1246         break;
1247     case SM501_2D_STATUS:
1248         ret = 0; /* Should return interrupt status */
1249         break;
1250     default:
1251         printf("sm501 disp ctrl : not implemented register read."
1252                " addr=%x\n", (int)addr);
1253         abort();
1254     }
1255 
1256     return ret;
1257 }
1258 
1259 static void sm501_2d_engine_write(void *opaque, hwaddr addr,
1260                                   uint64_t value, unsigned size)
1261 {
1262     SM501State *s = (SM501State *)opaque;
1263     SM501_DPRINTF("sm501 2d engine regs : write addr=%x, val=%x\n",
1264                   (unsigned)addr, (unsigned)value);
1265 
1266     switch (addr) {
1267     case SM501_2D_SOURCE:
1268         s->twoD_source = value;
1269         break;
1270     case SM501_2D_DESTINATION:
1271         s->twoD_destination = value;
1272         break;
1273     case SM501_2D_DIMENSION:
1274         s->twoD_dimension = value;
1275         break;
1276     case SM501_2D_CONTROL:
1277         s->twoD_control = value;
1278 
1279         /* do 2d operation if start flag is set. */
1280         if (value & 0x80000000) {
1281             sm501_2d_operation(s);
1282             s->twoD_control &= ~0x80000000; /* start flag down */
1283         }
1284 
1285         break;
1286     case SM501_2D_PITCH:
1287         s->twoD_pitch = value;
1288         break;
1289     case SM501_2D_FOREGROUND:
1290         s->twoD_foreground = value;
1291         break;
1292     case SM501_2D_BACKGROUND:
1293         s->twoD_background = value;
1294         break;
1295     case SM501_2D_STRETCH:
1296         s->twoD_stretch = value;
1297         break;
1298     case SM501_2D_COLOR_COMPARE:
1299         s->twoD_color_compare = value;
1300         break;
1301     case SM501_2D_COLOR_COMPARE_MASK:
1302         s->twoD_color_compare_mask = value;
1303         break;
1304     case SM501_2D_MASK:
1305         s->twoD_mask = value;
1306         break;
1307     case SM501_2D_CLIP_TL:
1308         s->twoD_clip_tl = value;
1309         break;
1310     case SM501_2D_CLIP_BR:
1311         s->twoD_clip_br = value;
1312         break;
1313     case SM501_2D_MONO_PATTERN_LOW:
1314         s->twoD_mono_pattern_low = value;
1315         break;
1316     case SM501_2D_MONO_PATTERN_HIGH:
1317         s->twoD_mono_pattern_high = value;
1318         break;
1319     case SM501_2D_WINDOW_WIDTH:
1320         s->twoD_window_width = value;
1321         break;
1322     case SM501_2D_SOURCE_BASE:
1323         s->twoD_source_base = value;
1324         break;
1325     case SM501_2D_DESTINATION_BASE:
1326         s->twoD_destination_base = value;
1327         break;
1328     case SM501_2D_ALPHA:
1329         s->twoD_alpha = value;
1330         break;
1331     case SM501_2D_WRAP:
1332         s->twoD_wrap = value;
1333         break;
1334     case SM501_2D_STATUS:
1335         /* ignored, writing 0 should clear interrupt status */
1336         break;
1337     default:
1338         printf("sm501 2d engine : not implemented register write."
1339                " addr=%x, val=%x\n", (int)addr, (unsigned)value);
1340         abort();
1341     }
1342 }
1343 
1344 static const MemoryRegionOps sm501_2d_engine_ops = {
1345     .read = sm501_2d_engine_read,
1346     .write = sm501_2d_engine_write,
1347     .valid = {
1348         .min_access_size = 4,
1349         .max_access_size = 4,
1350     },
1351     .endianness = DEVICE_LITTLE_ENDIAN,
1352 };
1353 
1354 /* draw line functions for all console modes */
1355 
1356 typedef void draw_line_func(uint8_t *d, const uint8_t *s,
1357                             int width, const uint32_t *pal);
1358 
1359 typedef void draw_hwc_line_func(uint8_t *d, const uint8_t *s,
1360                                 int width, const uint8_t *palette,
1361                                 int c_x, int c_y);
1362 
1363 #define DEPTH 8
1364 #include "sm501_template.h"
1365 
1366 #define DEPTH 15
1367 #include "sm501_template.h"
1368 
1369 #define BGR_FORMAT
1370 #define DEPTH 15
1371 #include "sm501_template.h"
1372 
1373 #define DEPTH 16
1374 #include "sm501_template.h"
1375 
1376 #define BGR_FORMAT
1377 #define DEPTH 16
1378 #include "sm501_template.h"
1379 
1380 #define DEPTH 32
1381 #include "sm501_template.h"
1382 
1383 #define BGR_FORMAT
1384 #define DEPTH 32
1385 #include "sm501_template.h"
1386 
1387 static draw_line_func *draw_line8_funcs[] = {
1388     draw_line8_8,
1389     draw_line8_15,
1390     draw_line8_16,
1391     draw_line8_32,
1392     draw_line8_32bgr,
1393     draw_line8_15bgr,
1394     draw_line8_16bgr,
1395 };
1396 
1397 static draw_line_func *draw_line16_funcs[] = {
1398     draw_line16_8,
1399     draw_line16_15,
1400     draw_line16_16,
1401     draw_line16_32,
1402     draw_line16_32bgr,
1403     draw_line16_15bgr,
1404     draw_line16_16bgr,
1405 };
1406 
1407 static draw_line_func *draw_line32_funcs[] = {
1408     draw_line32_8,
1409     draw_line32_15,
1410     draw_line32_16,
1411     draw_line32_32,
1412     draw_line32_32bgr,
1413     draw_line32_15bgr,
1414     draw_line32_16bgr,
1415 };
1416 
1417 static draw_hwc_line_func *draw_hwc_line_funcs[] = {
1418     draw_hwc_line_8,
1419     draw_hwc_line_15,
1420     draw_hwc_line_16,
1421     draw_hwc_line_32,
1422     draw_hwc_line_32bgr,
1423     draw_hwc_line_15bgr,
1424     draw_hwc_line_16bgr,
1425 };
1426 
1427 static inline int get_depth_index(DisplaySurface *surface)
1428 {
1429     switch (surface_bits_per_pixel(surface)) {
1430     default:
1431     case 8:
1432         return 0;
1433     case 15:
1434         return 1;
1435     case 16:
1436         return 2;
1437     case 32:
1438         if (is_surface_bgr(surface)) {
1439             return 4;
1440         } else {
1441             return 3;
1442         }
1443     }
1444 }
1445 
1446 static void sm501_update_display(void *opaque)
1447 {
1448     SM501State *s = (SM501State *)opaque;
1449     DisplaySurface *surface = qemu_console_surface(s->con);
1450     DirtyBitmapSnapshot *snap;
1451     int y, c_x = 0, c_y = 0;
1452     int crt = (s->dc_crt_control & SM501_DC_CRT_CONTROL_SEL) ? 1 : 0;
1453     int width = get_width(s, crt);
1454     int height = get_height(s, crt);
1455     int src_bpp = get_bpp(s, crt);
1456     int dst_bpp = surface_bytes_per_pixel(surface);
1457     int dst_depth_index = get_depth_index(surface);
1458     draw_line_func *draw_line = NULL;
1459     draw_hwc_line_func *draw_hwc_line = NULL;
1460     int full_update = 0;
1461     int y_start = -1;
1462     ram_addr_t offset = 0;
1463     uint32_t *palette;
1464     uint8_t hwc_palette[3 * 3];
1465     uint8_t *hwc_src = NULL;
1466 
1467     if (!((crt ? s->dc_crt_control : s->dc_panel_control)
1468           & SM501_DC_CRT_CONTROL_ENABLE)) {
1469         return;
1470     }
1471 
1472     palette = (uint32_t *)(crt ? &s->dc_palette[SM501_DC_CRT_PALETTE -
1473                                                 SM501_DC_PANEL_PALETTE]
1474                                : &s->dc_palette[0]);
1475 
1476     /* choose draw_line function */
1477     switch (src_bpp) {
1478     case 1:
1479         draw_line = draw_line8_funcs[dst_depth_index];
1480         break;
1481     case 2:
1482         draw_line = draw_line16_funcs[dst_depth_index];
1483         break;
1484     case 4:
1485         draw_line = draw_line32_funcs[dst_depth_index];
1486         break;
1487     default:
1488         printf("sm501 update display : invalid control register value.\n");
1489         abort();
1490         break;
1491     }
1492 
1493     /* set up to draw hardware cursor */
1494     if (is_hwc_enabled(s, crt)) {
1495         /* choose cursor draw line function */
1496         draw_hwc_line = draw_hwc_line_funcs[dst_depth_index];
1497         hwc_src = get_hwc_address(s, crt);
1498         c_x = get_hwc_x(s, crt);
1499         c_y = get_hwc_y(s, crt);
1500         get_hwc_palette(s, crt, hwc_palette);
1501     }
1502 
1503     /* adjust console size */
1504     if (s->last_width != width || s->last_height != height) {
1505         qemu_console_resize(s->con, width, height);
1506         surface = qemu_console_surface(s->con);
1507         s->last_width = width;
1508         s->last_height = height;
1509         full_update = 1;
1510     }
1511 
1512     /* draw each line according to conditions */
1513     snap = memory_region_snapshot_and_clear_dirty(&s->local_mem_region,
1514               offset, width * height * src_bpp, DIRTY_MEMORY_VGA);
1515     for (y = 0, offset = 0; y < height; y++, offset += width * src_bpp) {
1516         int update, update_hwc;
1517 
1518         /* check if hardware cursor is enabled and we're within its range */
1519         update_hwc = draw_hwc_line && c_y <= y && y < c_y + SM501_HWC_HEIGHT;
1520         update = full_update || update_hwc;
1521         /* check dirty flags for each line */
1522         update |= memory_region_snapshot_get_dirty(&s->local_mem_region, snap,
1523                                                    offset, width * src_bpp);
1524 
1525         /* draw line and change status */
1526         if (update) {
1527             uint8_t *d = surface_data(surface);
1528             d +=  y * width * dst_bpp;
1529 
1530             /* draw graphics layer */
1531             draw_line(d, s->local_mem + offset, width, palette);
1532 
1533             /* draw hardware cursor */
1534             if (update_hwc) {
1535                 draw_hwc_line(d, hwc_src, width, hwc_palette, c_x, y - c_y);
1536             }
1537 
1538             if (y_start < 0) {
1539                 y_start = y;
1540             }
1541         } else {
1542             if (y_start >= 0) {
1543                 /* flush to display */
1544                 dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1545                 y_start = -1;
1546             }
1547         }
1548     }
1549     g_free(snap);
1550 
1551     /* complete flush to display */
1552     if (y_start >= 0) {
1553         dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
1554     }
1555 }
1556 
1557 static const GraphicHwOps sm501_ops = {
1558     .gfx_update  = sm501_update_display,
1559 };
1560 
1561 static void sm501_reset(SM501State *s)
1562 {
1563     s->system_control = 0x00100000; /* 2D engine FIFO empty */
1564     /* Bits 17 (SH), 7 (CDR), 6:5 (Test), 2:0 (Bus) are all supposed
1565      * to be determined at reset by GPIO lines which set config bits.
1566      * We hardwire them:
1567      *  SH = 0 : Hitachi Ready Polarity == Active Low
1568      *  CDR = 0 : do not reset clock divider
1569      *  TEST = 0 : Normal mode (not testing the silicon)
1570      *  BUS = 0 : Hitachi SH3/SH4
1571      */
1572     s->misc_control = SM501_MISC_DAC_POWER;
1573     s->gpio_31_0_control = 0;
1574     s->gpio_63_32_control = 0;
1575     s->dram_control = 0;
1576     s->arbitration_control = 0x05146732;
1577     s->irq_mask = 0;
1578     s->misc_timing = 0;
1579     s->power_mode_control = 0;
1580     s->dc_panel_control = 0x00010000; /* FIFO level 3 */
1581     s->dc_video_control = 0;
1582     s->dc_crt_control = 0x00010000;
1583     s->twoD_source = 0;
1584     s->twoD_destination = 0;
1585     s->twoD_dimension = 0;
1586     s->twoD_control = 0;
1587     s->twoD_pitch = 0;
1588     s->twoD_foreground = 0;
1589     s->twoD_background = 0;
1590     s->twoD_stretch = 0;
1591     s->twoD_color_compare = 0;
1592     s->twoD_color_compare_mask = 0;
1593     s->twoD_mask = 0;
1594     s->twoD_clip_tl = 0;
1595     s->twoD_clip_br = 0;
1596     s->twoD_mono_pattern_low = 0;
1597     s->twoD_mono_pattern_high = 0;
1598     s->twoD_window_width = 0;
1599     s->twoD_source_base = 0;
1600     s->twoD_destination_base = 0;
1601     s->twoD_alpha = 0;
1602     s->twoD_wrap = 0;
1603 }
1604 
1605 static void sm501_init(SM501State *s, DeviceState *dev,
1606                        uint32_t local_mem_bytes)
1607 {
1608     s->local_mem_size_index = get_local_mem_size_index(local_mem_bytes);
1609     SM501_DPRINTF("sm501 local mem size=%x. index=%d\n", get_local_mem_size(s),
1610                   s->local_mem_size_index);
1611 
1612     /* local memory */
1613     memory_region_init_ram(&s->local_mem_region, OBJECT(dev), "sm501.local",
1614                            get_local_mem_size(s), &error_fatal);
1615     memory_region_set_log(&s->local_mem_region, true, DIRTY_MEMORY_VGA);
1616     s->local_mem = memory_region_get_ram_ptr(&s->local_mem_region);
1617 
1618     /* mmio */
1619     memory_region_init(&s->mmio_region, OBJECT(dev), "sm501.mmio", MMIO_SIZE);
1620     memory_region_init_io(&s->system_config_region, OBJECT(dev),
1621                           &sm501_system_config_ops, s,
1622                           "sm501-system-config", 0x6c);
1623     memory_region_add_subregion(&s->mmio_region, SM501_SYS_CONFIG,
1624                                 &s->system_config_region);
1625     memory_region_init_io(&s->disp_ctrl_region, OBJECT(dev),
1626                           &sm501_disp_ctrl_ops, s,
1627                           "sm501-disp-ctrl", 0x1000);
1628     memory_region_add_subregion(&s->mmio_region, SM501_DC,
1629                                 &s->disp_ctrl_region);
1630     memory_region_init_io(&s->twoD_engine_region, OBJECT(dev),
1631                           &sm501_2d_engine_ops, s,
1632                           "sm501-2d-engine", 0x54);
1633     memory_region_add_subregion(&s->mmio_region, SM501_2D_ENGINE,
1634                                 &s->twoD_engine_region);
1635 
1636     /* create qemu graphic console */
1637     s->con = graphic_console_init(DEVICE(dev), 0, &sm501_ops, s);
1638 }
1639 
1640 static const VMStateDescription vmstate_sm501_state = {
1641     .name = "sm501-state",
1642     .version_id = 1,
1643     .minimum_version_id = 1,
1644     .fields = (VMStateField[]) {
1645         VMSTATE_UINT32(local_mem_size_index, SM501State),
1646         VMSTATE_UINT32(system_control, SM501State),
1647         VMSTATE_UINT32(misc_control, SM501State),
1648         VMSTATE_UINT32(gpio_31_0_control, SM501State),
1649         VMSTATE_UINT32(gpio_63_32_control, SM501State),
1650         VMSTATE_UINT32(dram_control, SM501State),
1651         VMSTATE_UINT32(arbitration_control, SM501State),
1652         VMSTATE_UINT32(irq_mask, SM501State),
1653         VMSTATE_UINT32(misc_timing, SM501State),
1654         VMSTATE_UINT32(power_mode_control, SM501State),
1655         VMSTATE_UINT32(uart0_ier, SM501State),
1656         VMSTATE_UINT32(uart0_lcr, SM501State),
1657         VMSTATE_UINT32(uart0_mcr, SM501State),
1658         VMSTATE_UINT32(uart0_scr, SM501State),
1659         VMSTATE_UINT8_ARRAY(dc_palette, SM501State, DC_PALETTE_ENTRIES),
1660         VMSTATE_UINT32(dc_panel_control, SM501State),
1661         VMSTATE_UINT32(dc_panel_panning_control, SM501State),
1662         VMSTATE_UINT32(dc_panel_fb_addr, SM501State),
1663         VMSTATE_UINT32(dc_panel_fb_offset, SM501State),
1664         VMSTATE_UINT32(dc_panel_fb_width, SM501State),
1665         VMSTATE_UINT32(dc_panel_fb_height, SM501State),
1666         VMSTATE_UINT32(dc_panel_tl_location, SM501State),
1667         VMSTATE_UINT32(dc_panel_br_location, SM501State),
1668         VMSTATE_UINT32(dc_panel_h_total, SM501State),
1669         VMSTATE_UINT32(dc_panel_h_sync, SM501State),
1670         VMSTATE_UINT32(dc_panel_v_total, SM501State),
1671         VMSTATE_UINT32(dc_panel_v_sync, SM501State),
1672         VMSTATE_UINT32(dc_panel_hwc_addr, SM501State),
1673         VMSTATE_UINT32(dc_panel_hwc_location, SM501State),
1674         VMSTATE_UINT32(dc_panel_hwc_color_1_2, SM501State),
1675         VMSTATE_UINT32(dc_panel_hwc_color_3, SM501State),
1676         VMSTATE_UINT32(dc_video_control, SM501State),
1677         VMSTATE_UINT32(dc_crt_control, SM501State),
1678         VMSTATE_UINT32(dc_crt_fb_addr, SM501State),
1679         VMSTATE_UINT32(dc_crt_fb_offset, SM501State),
1680         VMSTATE_UINT32(dc_crt_h_total, SM501State),
1681         VMSTATE_UINT32(dc_crt_h_sync, SM501State),
1682         VMSTATE_UINT32(dc_crt_v_total, SM501State),
1683         VMSTATE_UINT32(dc_crt_v_sync, SM501State),
1684         VMSTATE_UINT32(dc_crt_hwc_addr, SM501State),
1685         VMSTATE_UINT32(dc_crt_hwc_location, SM501State),
1686         VMSTATE_UINT32(dc_crt_hwc_color_1_2, SM501State),
1687         VMSTATE_UINT32(dc_crt_hwc_color_3, SM501State),
1688         VMSTATE_UINT32(twoD_source, SM501State),
1689         VMSTATE_UINT32(twoD_destination, SM501State),
1690         VMSTATE_UINT32(twoD_dimension, SM501State),
1691         VMSTATE_UINT32(twoD_control, SM501State),
1692         VMSTATE_UINT32(twoD_pitch, SM501State),
1693         VMSTATE_UINT32(twoD_foreground, SM501State),
1694         VMSTATE_UINT32(twoD_background, SM501State),
1695         VMSTATE_UINT32(twoD_stretch, SM501State),
1696         VMSTATE_UINT32(twoD_color_compare, SM501State),
1697         VMSTATE_UINT32(twoD_color_compare_mask, SM501State),
1698         VMSTATE_UINT32(twoD_mask, SM501State),
1699         VMSTATE_UINT32(twoD_clip_tl, SM501State),
1700         VMSTATE_UINT32(twoD_clip_br, SM501State),
1701         VMSTATE_UINT32(twoD_mono_pattern_low, SM501State),
1702         VMSTATE_UINT32(twoD_mono_pattern_high, SM501State),
1703         VMSTATE_UINT32(twoD_window_width, SM501State),
1704         VMSTATE_UINT32(twoD_source_base, SM501State),
1705         VMSTATE_UINT32(twoD_destination_base, SM501State),
1706         VMSTATE_UINT32(twoD_alpha, SM501State),
1707         VMSTATE_UINT32(twoD_wrap, SM501State),
1708         VMSTATE_END_OF_LIST()
1709      }
1710 };
1711 
1712 #define TYPE_SYSBUS_SM501 "sysbus-sm501"
1713 #define SYSBUS_SM501(obj) \
1714     OBJECT_CHECK(SM501SysBusState, (obj), TYPE_SYSBUS_SM501)
1715 
1716 typedef struct {
1717     /*< private >*/
1718     SysBusDevice parent_obj;
1719     /*< public >*/
1720     SM501State state;
1721     uint32_t vram_size;
1722     uint32_t base;
1723     void *chr_state;
1724 } SM501SysBusState;
1725 
1726 static void sm501_realize_sysbus(DeviceState *dev, Error **errp)
1727 {
1728     SM501SysBusState *s = SYSBUS_SM501(dev);
1729     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1730     DeviceState *usb_dev;
1731 
1732     sm501_init(&s->state, dev, s->vram_size);
1733     if (get_local_mem_size(&s->state) != s->vram_size) {
1734         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
1735                    get_local_mem_size(&s->state));
1736         return;
1737     }
1738     sysbus_init_mmio(sbd, &s->state.local_mem_region);
1739     sysbus_init_mmio(sbd, &s->state.mmio_region);
1740 
1741     /* bridge to usb host emulation module */
1742     usb_dev = qdev_create(NULL, "sysbus-ohci");
1743     qdev_prop_set_uint32(usb_dev, "num-ports", 2);
1744     qdev_prop_set_uint64(usb_dev, "dma-offset", s->base);
1745     qdev_init_nofail(usb_dev);
1746     memory_region_add_subregion(&s->state.mmio_region, SM501_USB_HOST,
1747                        sysbus_mmio_get_region(SYS_BUS_DEVICE(usb_dev), 0));
1748     sysbus_pass_irq(sbd, SYS_BUS_DEVICE(usb_dev));
1749 
1750     /* bridge to serial emulation module */
1751     if (s->chr_state) {
1752         serial_mm_init(&s->state.mmio_region, SM501_UART0, 2,
1753                        NULL, /* TODO : chain irq to IRL */
1754                        115200, s->chr_state, DEVICE_LITTLE_ENDIAN);
1755     }
1756 }
1757 
1758 static Property sm501_sysbus_properties[] = {
1759     DEFINE_PROP_UINT32("vram-size", SM501SysBusState, vram_size, 0),
1760     DEFINE_PROP_UINT32("base", SM501SysBusState, base, 0),
1761     DEFINE_PROP_PTR("chr-state", SM501SysBusState, chr_state),
1762     DEFINE_PROP_END_OF_LIST(),
1763 };
1764 
1765 static void sm501_reset_sysbus(DeviceState *dev)
1766 {
1767     SM501SysBusState *s = SYSBUS_SM501(dev);
1768     sm501_reset(&s->state);
1769 }
1770 
1771 static const VMStateDescription vmstate_sm501_sysbus = {
1772     .name = TYPE_SYSBUS_SM501,
1773     .version_id = 1,
1774     .minimum_version_id = 1,
1775     .fields = (VMStateField[]) {
1776         VMSTATE_STRUCT(state, SM501SysBusState, 1,
1777                        vmstate_sm501_state, SM501State),
1778         VMSTATE_END_OF_LIST()
1779      }
1780 };
1781 
1782 static void sm501_sysbus_class_init(ObjectClass *klass, void *data)
1783 {
1784     DeviceClass *dc = DEVICE_CLASS(klass);
1785 
1786     dc->realize = sm501_realize_sysbus;
1787     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
1788     dc->desc = "SM501 Multimedia Companion";
1789     dc->props = sm501_sysbus_properties;
1790     dc->reset = sm501_reset_sysbus;
1791     dc->vmsd = &vmstate_sm501_sysbus;
1792     /* Note: pointer property "chr-state" may remain null, thus
1793      * no need for dc->user_creatable = false;
1794      */
1795 }
1796 
1797 static const TypeInfo sm501_sysbus_info = {
1798     .name          = TYPE_SYSBUS_SM501,
1799     .parent        = TYPE_SYS_BUS_DEVICE,
1800     .instance_size = sizeof(SM501SysBusState),
1801     .class_init    = sm501_sysbus_class_init,
1802 };
1803 
1804 #define TYPE_PCI_SM501 "sm501"
1805 #define PCI_SM501(obj) OBJECT_CHECK(SM501PCIState, (obj), TYPE_PCI_SM501)
1806 
1807 typedef struct {
1808     /*< private >*/
1809     PCIDevice parent_obj;
1810     /*< public >*/
1811     SM501State state;
1812     uint32_t vram_size;
1813 } SM501PCIState;
1814 
1815 static void sm501_realize_pci(PCIDevice *dev, Error **errp)
1816 {
1817     SM501PCIState *s = PCI_SM501(dev);
1818 
1819     sm501_init(&s->state, DEVICE(dev), s->vram_size);
1820     if (get_local_mem_size(&s->state) != s->vram_size) {
1821         error_setg(errp, "Invalid VRAM size, nearest valid size is %" PRIu32,
1822                    get_local_mem_size(&s->state));
1823         return;
1824     }
1825     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
1826                      &s->state.local_mem_region);
1827     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY,
1828                      &s->state.mmio_region);
1829 }
1830 
1831 static Property sm501_pci_properties[] = {
1832     DEFINE_PROP_UINT32("vram-size", SM501PCIState, vram_size, 64 * MiB),
1833     DEFINE_PROP_END_OF_LIST(),
1834 };
1835 
1836 static void sm501_reset_pci(DeviceState *dev)
1837 {
1838     SM501PCIState *s = PCI_SM501(dev);
1839     sm501_reset(&s->state);
1840     /* Bits 2:0 of misc_control register is 001 for PCI */
1841     s->state.misc_control |= 1;
1842 }
1843 
1844 static const VMStateDescription vmstate_sm501_pci = {
1845     .name = TYPE_PCI_SM501,
1846     .version_id = 1,
1847     .minimum_version_id = 1,
1848     .fields = (VMStateField[]) {
1849         VMSTATE_PCI_DEVICE(parent_obj, SM501PCIState),
1850         VMSTATE_STRUCT(state, SM501PCIState, 1,
1851                        vmstate_sm501_state, SM501State),
1852         VMSTATE_END_OF_LIST()
1853      }
1854 };
1855 
1856 static void sm501_pci_class_init(ObjectClass *klass, void *data)
1857 {
1858     DeviceClass *dc = DEVICE_CLASS(klass);
1859     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1860 
1861     k->realize = sm501_realize_pci;
1862     k->vendor_id = PCI_VENDOR_ID_SILICON_MOTION;
1863     k->device_id = PCI_DEVICE_ID_SM501;
1864     k->class_id = PCI_CLASS_DISPLAY_OTHER;
1865     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
1866     dc->desc = "SM501 Display Controller";
1867     dc->props = sm501_pci_properties;
1868     dc->reset = sm501_reset_pci;
1869     dc->hotpluggable = false;
1870     dc->vmsd = &vmstate_sm501_pci;
1871 }
1872 
1873 static const TypeInfo sm501_pci_info = {
1874     .name          = TYPE_PCI_SM501,
1875     .parent        = TYPE_PCI_DEVICE,
1876     .instance_size = sizeof(SM501PCIState),
1877     .class_init    = sm501_pci_class_init,
1878     .interfaces = (InterfaceInfo[]) {
1879         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1880         { },
1881     },
1882 };
1883 
1884 static void sm501_register_types(void)
1885 {
1886     type_register_static(&sm501_sysbus_info);
1887     type_register_static(&sm501_pci_info);
1888 }
1889 
1890 type_init(sm501_register_types)
1891