rtoss - Blame information for rev 79

Subversion Repositories:
Rev:
Rev Author Line No. Line
74 roytam 1 /*
2  * QEMU Cirrus CLGD 54xx VGA Emulator.
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  * Copyright (c) 2004 Makoto Suzuki (suzu)
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * Reference: Finn Thogersons' VGADOC4b
27  *   available at http://home.worldonline.dk/~finth/
28  */
29 #include "hw.h"
30 #include "pc.h"
31 #include "pci.h"
32 #include "console.h"
33 #include "vga_int.h"
34 #include "kvm.h"
35  
36 /*
37  * TODO:
38  *    - destination write mask support not complete (bits 5..7)
39  *    - optimize linear mappings
40  *    - optimize bitblt functions
41  */
42  
43 //#define DEBUG_CIRRUS
44 //#define DEBUG_BITBLT
45  
46 /***************************************
47  *
48  *  definitions
49  *
50  ***************************************/
51  
52 // ID
53 #define CIRRUS_ID_CLGD5422  (0x23<<2)
54 #define CIRRUS_ID_CLGD5426  (0x24<<2)
55 #define CIRRUS_ID_CLGD5424  (0x25<<2)
56 #define CIRRUS_ID_CLGD5428  (0x26<<2)
57 #define CIRRUS_ID_CLGD5430  (0x28<<2)
58 #define CIRRUS_ID_CLGD5434  (0x2A<<2)
59 #define CIRRUS_ID_CLGD5436  (0x2B<<2)
60 #define CIRRUS_ID_CLGD5446  (0x2E<<2)
61  
62 // sequencer 0x07
63 #define CIRRUS_SR7_BPP_VGA            0x00
64 #define CIRRUS_SR7_BPP_SVGA           0x01
65 #define CIRRUS_SR7_BPP_MASK           0x0e
66 #define CIRRUS_SR7_BPP_8              0x00
67 #define CIRRUS_SR7_BPP_16_DOUBLEVCLK  0x02
68 #define CIRRUS_SR7_BPP_24             0x04
69 #define CIRRUS_SR7_BPP_16             0x06
70 #define CIRRUS_SR7_BPP_32             0x08
71 #define CIRRUS_SR7_ISAADDR_MASK       0xe0
72  
73 // sequencer 0x0f
74 #define CIRRUS_MEMSIZE_512k        0x08
75 #define CIRRUS_MEMSIZE_1M          0x10
76 #define CIRRUS_MEMSIZE_2M          0x18
77 #define CIRRUS_MEMFLAGS_BANKSWITCH 0x80 // bank switching is enabled.
78  
79 // sequencer 0x12
80 #define CIRRUS_CURSOR_SHOW         0x01
81 #define CIRRUS_CURSOR_HIDDENPEL    0x02
82 #define CIRRUS_CURSOR_LARGE        0x04 // 64x64 if set, 32x32 if clear
83  
84 // sequencer 0x17
85 #define CIRRUS_BUSTYPE_VLBFAST   0x10
86 #define CIRRUS_BUSTYPE_PCI       0x20
87 #define CIRRUS_BUSTYPE_VLBSLOW   0x30
88 #define CIRRUS_BUSTYPE_ISA       0x38
89 #define CIRRUS_MMIO_ENABLE       0x04
90 #define CIRRUS_MMIO_USE_PCIADDR  0x40   // 0xb8000 if cleared.
91 #define CIRRUS_MEMSIZEEXT_DOUBLE 0x80
92  
93 // control 0x0b
94 #define CIRRUS_BANKING_DUAL             0x01
95 #define CIRRUS_BANKING_GRANULARITY_16K  0x20    // set:16k, clear:4k
96  
97 // control 0x30
98 #define CIRRUS_BLTMODE_BACKWARDS        0x01
99 #define CIRRUS_BLTMODE_MEMSYSDEST       0x02
100 #define CIRRUS_BLTMODE_MEMSYSSRC        0x04
101 #define CIRRUS_BLTMODE_TRANSPARENTCOMP  0x08
102 #define CIRRUS_BLTMODE_PATTERNCOPY      0x40
103 #define CIRRUS_BLTMODE_COLOREXPAND      0x80
104 #define CIRRUS_BLTMODE_PIXELWIDTHMASK   0x30
105 #define CIRRUS_BLTMODE_PIXELWIDTH8      0x00
106 #define CIRRUS_BLTMODE_PIXELWIDTH16     0x10
107 #define CIRRUS_BLTMODE_PIXELWIDTH24     0x20
108 #define CIRRUS_BLTMODE_PIXELWIDTH32     0x30
109  
110 // control 0x31
111 #define CIRRUS_BLT_BUSY                 0x01
112 #define CIRRUS_BLT_START                0x02
113 #define CIRRUS_BLT_RESET                0x04
114 #define CIRRUS_BLT_FIFOUSED             0x10
115 #define CIRRUS_BLT_AUTOSTART            0x80
116  
117 // control 0x32
118 #define CIRRUS_ROP_0                    0x00
119 #define CIRRUS_ROP_SRC_AND_DST          0x05
120 #define CIRRUS_ROP_NOP                  0x06
121 #define CIRRUS_ROP_SRC_AND_NOTDST       0x09
122 #define CIRRUS_ROP_NOTDST               0x0b
123 #define CIRRUS_ROP_SRC                  0x0d
124 #define CIRRUS_ROP_1                    0x0e
125 #define CIRRUS_ROP_NOTSRC_AND_DST       0x50
126 #define CIRRUS_ROP_SRC_XOR_DST          0x59
127 #define CIRRUS_ROP_SRC_OR_DST           0x6d
128 #define CIRRUS_ROP_NOTSRC_OR_NOTDST     0x90
129 #define CIRRUS_ROP_SRC_NOTXOR_DST       0x95
130 #define CIRRUS_ROP_SRC_OR_NOTDST        0xad
131 #define CIRRUS_ROP_NOTSRC               0xd0
132 #define CIRRUS_ROP_NOTSRC_OR_DST        0xd6
133 #define CIRRUS_ROP_NOTSRC_AND_NOTDST    0xda
134  
135 #define CIRRUS_ROP_NOP_INDEX 2
136 #define CIRRUS_ROP_SRC_INDEX 5
137  
138 // control 0x33
139 #define CIRRUS_BLTMODEEXT_SOLIDFILL        0x04
140 #define CIRRUS_BLTMODEEXT_COLOREXPINV      0x02
141 #define CIRRUS_BLTMODEEXT_DWORDGRANULARITY 0x01
142  
143 // memory-mapped IO
144 #define CIRRUS_MMIO_BLTBGCOLOR        0x00      // dword
145 #define CIRRUS_MMIO_BLTFGCOLOR        0x04      // dword
146 #define CIRRUS_MMIO_BLTWIDTH          0x08      // word
147 #define CIRRUS_MMIO_BLTHEIGHT         0x0a      // word
148 #define CIRRUS_MMIO_BLTDESTPITCH      0x0c      // word
149 #define CIRRUS_MMIO_BLTSRCPITCH       0x0e      // word
150 #define CIRRUS_MMIO_BLTDESTADDR       0x10      // dword
151 #define CIRRUS_MMIO_BLTSRCADDR        0x14      // dword
152 #define CIRRUS_MMIO_BLTWRITEMASK      0x17      // byte
153 #define CIRRUS_MMIO_BLTMODE           0x18      // byte
154 #define CIRRUS_MMIO_BLTROP            0x1a      // byte
155 #define CIRRUS_MMIO_BLTMODEEXT        0x1b      // byte
156 #define CIRRUS_MMIO_BLTTRANSPARENTCOLOR 0x1c    // word?
157 #define CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK 0x20        // word?
158 #define CIRRUS_MMIO_LINEARDRAW_START_X 0x24     // word
159 #define CIRRUS_MMIO_LINEARDRAW_START_Y 0x26     // word
160 #define CIRRUS_MMIO_LINEARDRAW_END_X  0x28      // word
161 #define CIRRUS_MMIO_LINEARDRAW_END_Y  0x2a      // word
162 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_INC 0x2c       // byte
163 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ROLLOVER 0x2d  // byte
164 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_MASK 0x2e      // byte
165 #define CIRRUS_MMIO_LINEARDRAW_LINESTYLE_ACCUM 0x2f     // byte
166 #define CIRRUS_MMIO_BRESENHAM_K1      0x30      // word
167 #define CIRRUS_MMIO_BRESENHAM_K3      0x32      // word
168 #define CIRRUS_MMIO_BRESENHAM_ERROR   0x34      // word
169 #define CIRRUS_MMIO_BRESENHAM_DELTA_MAJOR 0x36  // word
170 #define CIRRUS_MMIO_BRESENHAM_DIRECTION 0x38    // byte
171 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39      // byte
172 #define CIRRUS_MMIO_BLTSTATUS         0x40      // byte
173  
174 // PCI 0x04: command(word), 0x06(word): status
175 #define PCI_COMMAND_IOACCESS                0x0001
176 #define PCI_COMMAND_MEMACCESS               0x0002
177 #define PCI_COMMAND_BUSMASTER               0x0004
178 #define PCI_COMMAND_SPECIALCYCLE            0x0008
179 #define PCI_COMMAND_MEMWRITEINVALID         0x0010
180 #define PCI_COMMAND_PALETTESNOOPING         0x0020
181 #define PCI_COMMAND_PARITYDETECTION         0x0040
182 #define PCI_COMMAND_ADDRESSDATASTEPPING     0x0080
183 #define PCI_COMMAND_SERR                    0x0100
184 #define PCI_COMMAND_BACKTOBACKTRANS         0x0200
185 // PCI 0x08, 0xff000000 (0x09-0x0b:class,0x08:rev)
186 #define PCI_CLASS_BASE_DISPLAY        0x03
187 // PCI 0x08, 0x00ff0000
188 #define PCI_CLASS_SUB_VGA             0x00
189 // PCI 0x0c, 0x00ff0000 (0x0c:cacheline,0x0d:latency,0x0e:headertype,0x0f:Built-in self test)
190 // 0x10-0x3f (headertype 00h)
191 // PCI 0x10,0x14,0x18,0x1c,0x20,0x24: base address mapping registers
192 //   0x10: MEMBASE, 0x14: IOBASE(hard-coded in XFree86 3.x)
193 #define PCI_MAP_MEM                 0x0
194 #define PCI_MAP_IO                  0x1
195 #define PCI_MAP_MEM_ADDR_MASK       (~0xf)
196 #define PCI_MAP_IO_ADDR_MASK        (~0x3)
197 #define PCI_MAP_MEMFLAGS_32BIT      0x0
198 #define PCI_MAP_MEMFLAGS_32BIT_1M   0x1
199 #define PCI_MAP_MEMFLAGS_64BIT      0x4
200 #define PCI_MAP_MEMFLAGS_CACHEABLE  0x8
201 // PCI 0x28: cardbus CIS pointer
202 // PCI 0x2c: subsystem vendor id, 0x2e: subsystem id
203 // PCI 0x30: expansion ROM base address
204 #define PCI_ROMBIOS_ENABLED         0x1
205 // PCI 0x34: 0xffffff00=reserved, 0x000000ff=capabilities pointer
206 // PCI 0x38: reserved
207 // PCI 0x3c: 0x3c=int-line, 0x3d=int-pin, 0x3e=min-gnt, 0x3f=maax-lat
208  
209 #define CIRRUS_PNPMMIO_SIZE         0x1000
210  
211 #define ABS(a) ((signed)(a) > 0 ? a : -a)
212  
213 #define BLTUNSAFE(s) \
214     ( \
215         ( /* check dst is within bounds */ \
216             (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
217                 + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
218                     (s)->vga.vram_size \
219         ) || \
220         ( /* check src is within bounds */ \
221             (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
222                 + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
223                     (s)->vga.vram_size \
224         ) \
225     )
226  
227 struct CirrusVGAState;
228 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
229                                      uint8_t * dst, const uint8_t * src,
230                                      int dstpitch, int srcpitch,
231                                      int bltwidth, int bltheight);
232 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
233                               uint8_t *dst, int dst_pitch, int width, int height);
234  
235 typedef struct CirrusVGAState {
236     VGACommonState vga;
237  
238     int cirrus_linear_io_addr;
239     int cirrus_linear_bitblt_io_addr;
240     int cirrus_mmio_io_addr;
241     uint32_t cirrus_addr_mask;
242     uint32_t linear_mmio_mask;
243     uint8_t cirrus_shadow_gr0;
244     uint8_t cirrus_shadow_gr1;
245     uint8_t cirrus_hidden_dac_lockindex;
246     uint8_t cirrus_hidden_dac_data;
247     uint32_t cirrus_bank_base[2];
248     uint32_t cirrus_bank_limit[2];
249     uint8_t cirrus_hidden_palette[48];
250     uint32_t hw_cursor_x;
251     uint32_t hw_cursor_y;
252     int cirrus_blt_pixelwidth;
253     int cirrus_blt_width;
254     int cirrus_blt_height;
255     int cirrus_blt_dstpitch;
256     int cirrus_blt_srcpitch;
257     uint32_t cirrus_blt_fgcol;
258     uint32_t cirrus_blt_bgcol;
259     uint32_t cirrus_blt_dstaddr;
260     uint32_t cirrus_blt_srcaddr;
261     uint8_t cirrus_blt_mode;
262     uint8_t cirrus_blt_modeext;
263     cirrus_bitblt_rop_t cirrus_rop;
264 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
265     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
266     uint8_t *cirrus_srcptr;
267     uint8_t *cirrus_srcptr_end;
268     uint32_t cirrus_srccounter;
269     /* hwcursor display state */
270     int last_hw_cursor_size;
271     int last_hw_cursor_x;
272     int last_hw_cursor_y;
273     int last_hw_cursor_y_start;
274     int last_hw_cursor_y_end;
275     int real_vram_size; /* XXX: suppress that */
276     int device_id;
277     int bustype;
278 } CirrusVGAState;
279  
280 typedef struct PCICirrusVGAState {
281     PCIDevice dev;
282     CirrusVGAState cirrus_vga;
283 } PCICirrusVGAState;
284  
285 static uint8_t rop_to_index[256];
286  
287 /***************************************
288  *
289  *  prototypes.
290  *
291  ***************************************/
292  
293  
294 static void cirrus_bitblt_reset(CirrusVGAState *s);
295 static void cirrus_update_memory_access(CirrusVGAState *s);
296  
297 /***************************************
298  *
299  *  raster operations
300  *
301  ***************************************/
302  
303 static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
304                                   uint8_t *dst,const uint8_t *src,
305                                   int dstpitch,int srcpitch,
306                                   int bltwidth,int bltheight)
307 {
308 }
309  
310 static void cirrus_bitblt_fill_nop(CirrusVGAState *s,
311                                    uint8_t *dst,
312                                    int dstpitch, int bltwidth,int bltheight)
313 {
314 }
315  
316 #define ROP_NAME 0
317 #define ROP_OP(d, s) d = 0
318 #include "cirrus_vga_rop.h"
319  
320 #define ROP_NAME src_and_dst
321 #define ROP_OP(d, s) d = (s) & (d)
322 #include "cirrus_vga_rop.h"
323  
324 #define ROP_NAME src_and_notdst
325 #define ROP_OP(d, s) d = (s) & (~(d))
326 #include "cirrus_vga_rop.h"
327  
328 #define ROP_NAME notdst
329 #define ROP_OP(d, s) d = ~(d)
330 #include "cirrus_vga_rop.h"
331  
332 #define ROP_NAME src
333 #define ROP_OP(d, s) d = s
334 #include "cirrus_vga_rop.h"
335  
336 #define ROP_NAME 1
337 #define ROP_OP(d, s) d = ~0
338 #include "cirrus_vga_rop.h"
339  
340 #define ROP_NAME notsrc_and_dst
341 #define ROP_OP(d, s) d = (~(s)) & (d)
342 #include "cirrus_vga_rop.h"
343  
344 #define ROP_NAME src_xor_dst
345 #define ROP_OP(d, s) d = (s) ^ (d)
346 #include "cirrus_vga_rop.h"
347  
348 #define ROP_NAME src_or_dst
349 #define ROP_OP(d, s) d = (s) | (d)
350 #include "cirrus_vga_rop.h"
351  
352 #define ROP_NAME notsrc_or_notdst
353 #define ROP_OP(d, s) d = (~(s)) | (~(d))
354 #include "cirrus_vga_rop.h"
355  
356 #define ROP_NAME src_notxor_dst
357 #define ROP_OP(d, s) d = ~((s) ^ (d))
358 #include "cirrus_vga_rop.h"
359  
360 #define ROP_NAME src_or_notdst
361 #define ROP_OP(d, s) d = (s) | (~(d))
362 #include "cirrus_vga_rop.h"
363  
364 #define ROP_NAME notsrc
365 #define ROP_OP(d, s) d = (~(s))
366 #include "cirrus_vga_rop.h"
367  
368 #define ROP_NAME notsrc_or_dst
369 #define ROP_OP(d, s) d = (~(s)) | (d)
370 #include "cirrus_vga_rop.h"
371  
372 #define ROP_NAME notsrc_and_notdst
373 #define ROP_OP(d, s) d = (~(s)) & (~(d))
374 #include "cirrus_vga_rop.h"
375  
376 static const cirrus_bitblt_rop_t cirrus_fwd_rop[16] = {
377     cirrus_bitblt_rop_fwd_0,
378     cirrus_bitblt_rop_fwd_src_and_dst,
379     cirrus_bitblt_rop_nop,
380     cirrus_bitblt_rop_fwd_src_and_notdst,
381     cirrus_bitblt_rop_fwd_notdst,
382     cirrus_bitblt_rop_fwd_src,
383     cirrus_bitblt_rop_fwd_1,
384     cirrus_bitblt_rop_fwd_notsrc_and_dst,
385     cirrus_bitblt_rop_fwd_src_xor_dst,
386     cirrus_bitblt_rop_fwd_src_or_dst,
387     cirrus_bitblt_rop_fwd_notsrc_or_notdst,
388     cirrus_bitblt_rop_fwd_src_notxor_dst,
389     cirrus_bitblt_rop_fwd_src_or_notdst,
390     cirrus_bitblt_rop_fwd_notsrc,
391     cirrus_bitblt_rop_fwd_notsrc_or_dst,
392     cirrus_bitblt_rop_fwd_notsrc_and_notdst,
393 };
394  
395 static const cirrus_bitblt_rop_t cirrus_bkwd_rop[16] = {
396     cirrus_bitblt_rop_bkwd_0,
397     cirrus_bitblt_rop_bkwd_src_and_dst,
398     cirrus_bitblt_rop_nop,
399     cirrus_bitblt_rop_bkwd_src_and_notdst,
400     cirrus_bitblt_rop_bkwd_notdst,
401     cirrus_bitblt_rop_bkwd_src,
402     cirrus_bitblt_rop_bkwd_1,
403     cirrus_bitblt_rop_bkwd_notsrc_and_dst,
404     cirrus_bitblt_rop_bkwd_src_xor_dst,
405     cirrus_bitblt_rop_bkwd_src_or_dst,
406     cirrus_bitblt_rop_bkwd_notsrc_or_notdst,
407     cirrus_bitblt_rop_bkwd_src_notxor_dst,
408     cirrus_bitblt_rop_bkwd_src_or_notdst,
409     cirrus_bitblt_rop_bkwd_notsrc,
410     cirrus_bitblt_rop_bkwd_notsrc_or_dst,
411     cirrus_bitblt_rop_bkwd_notsrc_and_notdst,
412 };
413  
414 #define TRANSP_ROP(name) {\
415     name ## _8,\
416     name ## _16,\
417         }
418 #define TRANSP_NOP(func) {\
419     func,\
420     func,\
421         }
422  
423 static const cirrus_bitblt_rop_t cirrus_fwd_transp_rop[16][2] = {
424     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_0),
425     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_dst),
426     TRANSP_NOP(cirrus_bitblt_rop_nop),
427     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_and_notdst),
428     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notdst),
429     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src),
430     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_1),
431     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_dst),
432     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_xor_dst),
433     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_dst),
434     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_notdst),
435     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_notxor_dst),
436     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_src_or_notdst),
437     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc),
438     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_or_dst),
439     TRANSP_ROP(cirrus_bitblt_rop_fwd_transp_notsrc_and_notdst),
440 };
441  
442 static const cirrus_bitblt_rop_t cirrus_bkwd_transp_rop[16][2] = {
443     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_0),
444     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_dst),
445     TRANSP_NOP(cirrus_bitblt_rop_nop),
446     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_and_notdst),
447     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notdst),
448     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src),
449     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_1),
450     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_dst),
451     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_xor_dst),
452     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_dst),
453     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_notdst),
454     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_notxor_dst),
455     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_src_or_notdst),
456     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc),
457     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_or_dst),
458     TRANSP_ROP(cirrus_bitblt_rop_bkwd_transp_notsrc_and_notdst),
459 };
460  
461 #define ROP2(name) {\
462     name ## _8,\
463     name ## _16,\
464     name ## _24,\
465     name ## _32,\
466         }
467  
468 #define ROP_NOP2(func) {\
469     func,\
470     func,\
471     func,\
472     func,\
473         }
474  
475 static const cirrus_bitblt_rop_t cirrus_patternfill[16][4] = {
476     ROP2(cirrus_patternfill_0),
477     ROP2(cirrus_patternfill_src_and_dst),
478     ROP_NOP2(cirrus_bitblt_rop_nop),
479     ROP2(cirrus_patternfill_src_and_notdst),
480     ROP2(cirrus_patternfill_notdst),
481     ROP2(cirrus_patternfill_src),
482     ROP2(cirrus_patternfill_1),
483     ROP2(cirrus_patternfill_notsrc_and_dst),
484     ROP2(cirrus_patternfill_src_xor_dst),
485     ROP2(cirrus_patternfill_src_or_dst),
486     ROP2(cirrus_patternfill_notsrc_or_notdst),
487     ROP2(cirrus_patternfill_src_notxor_dst),
488     ROP2(cirrus_patternfill_src_or_notdst),
489     ROP2(cirrus_patternfill_notsrc),
490     ROP2(cirrus_patternfill_notsrc_or_dst),
491     ROP2(cirrus_patternfill_notsrc_and_notdst),
492 };
493  
494 static const cirrus_bitblt_rop_t cirrus_colorexpand_transp[16][4] = {
495     ROP2(cirrus_colorexpand_transp_0),
496     ROP2(cirrus_colorexpand_transp_src_and_dst),
497     ROP_NOP2(cirrus_bitblt_rop_nop),
498     ROP2(cirrus_colorexpand_transp_src_and_notdst),
499     ROP2(cirrus_colorexpand_transp_notdst),
500     ROP2(cirrus_colorexpand_transp_src),
501     ROP2(cirrus_colorexpand_transp_1),
502     ROP2(cirrus_colorexpand_transp_notsrc_and_dst),
503     ROP2(cirrus_colorexpand_transp_src_xor_dst),
504     ROP2(cirrus_colorexpand_transp_src_or_dst),
505     ROP2(cirrus_colorexpand_transp_notsrc_or_notdst),
506     ROP2(cirrus_colorexpand_transp_src_notxor_dst),
507     ROP2(cirrus_colorexpand_transp_src_or_notdst),
508     ROP2(cirrus_colorexpand_transp_notsrc),
509     ROP2(cirrus_colorexpand_transp_notsrc_or_dst),
510     ROP2(cirrus_colorexpand_transp_notsrc_and_notdst),
511 };
512  
513 static const cirrus_bitblt_rop_t cirrus_colorexpand[16][4] = {
514     ROP2(cirrus_colorexpand_0),
515     ROP2(cirrus_colorexpand_src_and_dst),
516     ROP_NOP2(cirrus_bitblt_rop_nop),
517     ROP2(cirrus_colorexpand_src_and_notdst),
518     ROP2(cirrus_colorexpand_notdst),
519     ROP2(cirrus_colorexpand_src),
520     ROP2(cirrus_colorexpand_1),
521     ROP2(cirrus_colorexpand_notsrc_and_dst),
522     ROP2(cirrus_colorexpand_src_xor_dst),
523     ROP2(cirrus_colorexpand_src_or_dst),
524     ROP2(cirrus_colorexpand_notsrc_or_notdst),
525     ROP2(cirrus_colorexpand_src_notxor_dst),
526     ROP2(cirrus_colorexpand_src_or_notdst),
527     ROP2(cirrus_colorexpand_notsrc),
528     ROP2(cirrus_colorexpand_notsrc_or_dst),
529     ROP2(cirrus_colorexpand_notsrc_and_notdst),
530 };
531  
532 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern_transp[16][4] = {
533     ROP2(cirrus_colorexpand_pattern_transp_0),
534     ROP2(cirrus_colorexpand_pattern_transp_src_and_dst),
535     ROP_NOP2(cirrus_bitblt_rop_nop),
536     ROP2(cirrus_colorexpand_pattern_transp_src_and_notdst),
537     ROP2(cirrus_colorexpand_pattern_transp_notdst),
538     ROP2(cirrus_colorexpand_pattern_transp_src),
539     ROP2(cirrus_colorexpand_pattern_transp_1),
540     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_dst),
541     ROP2(cirrus_colorexpand_pattern_transp_src_xor_dst),
542     ROP2(cirrus_colorexpand_pattern_transp_src_or_dst),
543     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_notdst),
544     ROP2(cirrus_colorexpand_pattern_transp_src_notxor_dst),
545     ROP2(cirrus_colorexpand_pattern_transp_src_or_notdst),
546     ROP2(cirrus_colorexpand_pattern_transp_notsrc),
547     ROP2(cirrus_colorexpand_pattern_transp_notsrc_or_dst),
548     ROP2(cirrus_colorexpand_pattern_transp_notsrc_and_notdst),
549 };
550  
551 static const cirrus_bitblt_rop_t cirrus_colorexpand_pattern[16][4] = {
552     ROP2(cirrus_colorexpand_pattern_0),
553     ROP2(cirrus_colorexpand_pattern_src_and_dst),
554     ROP_NOP2(cirrus_bitblt_rop_nop),
555     ROP2(cirrus_colorexpand_pattern_src_and_notdst),
556     ROP2(cirrus_colorexpand_pattern_notdst),
557     ROP2(cirrus_colorexpand_pattern_src),
558     ROP2(cirrus_colorexpand_pattern_1),
559     ROP2(cirrus_colorexpand_pattern_notsrc_and_dst),
560     ROP2(cirrus_colorexpand_pattern_src_xor_dst),
561     ROP2(cirrus_colorexpand_pattern_src_or_dst),
562     ROP2(cirrus_colorexpand_pattern_notsrc_or_notdst),
563     ROP2(cirrus_colorexpand_pattern_src_notxor_dst),
564     ROP2(cirrus_colorexpand_pattern_src_or_notdst),
565     ROP2(cirrus_colorexpand_pattern_notsrc),
566     ROP2(cirrus_colorexpand_pattern_notsrc_or_dst),
567     ROP2(cirrus_colorexpand_pattern_notsrc_and_notdst),
568 };
569  
570 static const cirrus_fill_t cirrus_fill[16][4] = {
571     ROP2(cirrus_fill_0),
572     ROP2(cirrus_fill_src_and_dst),
573     ROP_NOP2(cirrus_bitblt_fill_nop),
574     ROP2(cirrus_fill_src_and_notdst),
575     ROP2(cirrus_fill_notdst),
576     ROP2(cirrus_fill_src),
577     ROP2(cirrus_fill_1),
578     ROP2(cirrus_fill_notsrc_and_dst),
579     ROP2(cirrus_fill_src_xor_dst),
580     ROP2(cirrus_fill_src_or_dst),
581     ROP2(cirrus_fill_notsrc_or_notdst),
582     ROP2(cirrus_fill_src_notxor_dst),
583     ROP2(cirrus_fill_src_or_notdst),
584     ROP2(cirrus_fill_notsrc),
585     ROP2(cirrus_fill_notsrc_or_dst),
586     ROP2(cirrus_fill_notsrc_and_notdst),
587 };
588  
589 static inline void cirrus_bitblt_fgcol(CirrusVGAState *s)
590 {
591     unsigned int color;
592     switch (s->cirrus_blt_pixelwidth) {
593     case 1:
594         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1;
595         break;
596     case 2:
597         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8);
598         s->cirrus_blt_fgcol = le16_to_cpu(color);
599         break;
600     case 3:
601         s->cirrus_blt_fgcol = s->cirrus_shadow_gr1 |
602             (s->vga.gr[0x11] << 8) | (s->vga.gr[0x13] << 16);
603         break;
604     default:
605     case 4:
606         color = s->cirrus_shadow_gr1 | (s->vga.gr[0x11] << 8) |
607             (s->vga.gr[0x13] << 16) | (s->vga.gr[0x15] << 24);
608         s->cirrus_blt_fgcol = le32_to_cpu(color);
609         break;
610     }
611 }
612  
613 static inline void cirrus_bitblt_bgcol(CirrusVGAState *s)
614 {
615     unsigned int color;
616     switch (s->cirrus_blt_pixelwidth) {
617     case 1:
618         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0;
619         break;
620     case 2:
621         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8);
622         s->cirrus_blt_bgcol = le16_to_cpu(color);
623         break;
624     case 3:
625         s->cirrus_blt_bgcol = s->cirrus_shadow_gr0 |
626             (s->vga.gr[0x10] << 8) | (s->vga.gr[0x12] << 16);
627         break;
628     default:
629     case 4:
630         color = s->cirrus_shadow_gr0 | (s->vga.gr[0x10] << 8) |
631             (s->vga.gr[0x12] << 16) | (s->vga.gr[0x14] << 24);
632         s->cirrus_blt_bgcol = le32_to_cpu(color);
633         break;
634     }
635 }
636  
637 static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
638                                      int off_pitch, int bytesperline,
639                                      int lines)
640 {
641     int y;
642     int off_cur;
643     int off_cur_end;
644  
645     for (y = 0; y < lines; y++) {
646         off_cur = off_begin;
647         off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
648         off_cur &= TARGET_PAGE_MASK;
649         while (off_cur < off_cur_end) {
650             cpu_physical_memory_set_dirty(s->vga.vram_offset + off_cur);
651             off_cur += TARGET_PAGE_SIZE;
652         }
653         off_begin += off_pitch;
654     }
655 }
656  
657 static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
658                                             const uint8_t * src)
659 {
660     uint8_t *dst;
661  
662     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
663  
664     if (BLTUNSAFE(s))
665         return 0;
666  
667     (*s->cirrus_rop) (s, dst, src,
668                       s->cirrus_blt_dstpitch, 0,
669                       s->cirrus_blt_width, s->cirrus_blt_height);
670     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
671                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
672                              s->cirrus_blt_height);
673     return 1;
674 }
675  
676 /* fill */
677  
678 static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
679 {
680     cirrus_fill_t rop_func;
681  
682     if (BLTUNSAFE(s))
683         return 0;
684     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
685     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
686              s->cirrus_blt_dstpitch,
687              s->cirrus_blt_width, s->cirrus_blt_height);
688     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
689                              s->cirrus_blt_dstpitch, s->cirrus_blt_width,
690                              s->cirrus_blt_height);
691     cirrus_bitblt_reset(s);
692     return 1;
693 }
694  
695 /***************************************
696  *
697  *  bitblt (video-to-video)
698  *
699  ***************************************/
700  
701 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
702 {
703     return cirrus_bitblt_common_patterncopy(s,
704                                             s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
705                                             s->cirrus_addr_mask));
706 }
707  
708 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
709 {
710     int sx, sy;
711     int dx, dy;
712     int width, height;
713     int depth;
714     int notify = 0;
715  
716     depth = s->vga.get_bpp(&s->vga) / 8;
717     s->vga.get_resolution(&s->vga, &width, &height);
718  
719     /* extra x, y */
720     sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
721     sy = (src / ABS(s->cirrus_blt_srcpitch));
722     dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
723     dy = (dst / ABS(s->cirrus_blt_dstpitch));
724  
725     /* normalize width */
726     w /= depth;
727  
728     /* if we're doing a backward copy, we have to adjust
729        our x/y to be the upper left corner (instead of the lower
730        right corner) */
731     if (s->cirrus_blt_dstpitch < 0) {
732         sx -= (s->cirrus_blt_width / depth) - 1;
733         dx -= (s->cirrus_blt_width / depth) - 1;
734         sy -= s->cirrus_blt_height - 1;
735         dy -= s->cirrus_blt_height - 1;
736     }
737  
738     /* are we in the visible portion of memory? */
739     if (sx >= 0 && sy >= 0 && dx >= 0 && dy >= 0 &&
740         (sx + w) <= width && (sy + h) <= height &&
741         (dx + w) <= width && (dy + h) <= height) {
742         notify = 1;
743     }
744  
745     /* make to sure only copy if it's a plain copy ROP */
746     if (*s->cirrus_rop != cirrus_bitblt_rop_fwd_src &&
747         *s->cirrus_rop != cirrus_bitblt_rop_bkwd_src)
748         notify = 0;
749  
750     /* we have to flush all pending changes so that the copy
751        is generated at the appropriate moment in time */
752     if (notify)
753         vga_hw_update();
754  
755     (*s->cirrus_rop) (s, s->vga.vram_ptr +
756                       (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
757                       s->vga.vram_ptr +
758                       (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
759                       s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
760                       s->cirrus_blt_width, s->cirrus_blt_height);
761  
762     if (notify)
763         qemu_console_copy(s->vga.ds,
764                           sx, sy, dx, dy,
765                           s->cirrus_blt_width / depth,
766                           s->cirrus_blt_height);
767  
768     /* we don't have to notify the display that this portion has
769        changed since qemu_console_copy implies this */
770  
771     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
772                                 s->cirrus_blt_dstpitch, s->cirrus_blt_width,
773                                 s->cirrus_blt_height);
774 }
775  
776 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
777 {
778     if (BLTUNSAFE(s))
779         return 0;
780  
781     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
782             s->cirrus_blt_srcaddr - s->vga.start_addr,
783             s->cirrus_blt_width, s->cirrus_blt_height);
784  
785     return 1;
786 }
787  
788 /***************************************
789  *
790  *  bitblt (cpu-to-video)
791  *
792  ***************************************/
793  
794 static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
795 {
796     int copy_count;
797     uint8_t *end_ptr;
798  
799     if (s->cirrus_srccounter > 0) {
800         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
801             cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);
802         the_end:
803             s->cirrus_srccounter = 0;
804             cirrus_bitblt_reset(s);
805         } else {
806             /* at least one scan line */
807             do {
808                 (*s->cirrus_rop)(s, s->vga.vram_ptr +
809                                  (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
810                                   s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
811                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
812                                          s->cirrus_blt_width, 1);
813                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
814                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
815                 if (s->cirrus_srccounter <= 0)
816                     goto the_end;
817                 /* more bytes than needed can be transfered because of
818                    word alignment, so we keep them for the next line */
819                 /* XXX: keep alignment to speed up transfer */
820                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
821                 copy_count = s->cirrus_srcptr_end - end_ptr;
822                 memmove(s->cirrus_bltbuf, end_ptr, copy_count);
823                 s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;
824                 s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
825             } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);
826         }
827     }
828 }
829  
830 /***************************************
831  *
832  *  bitblt wrapper
833  *
834  ***************************************/
835  
836 static void cirrus_bitblt_reset(CirrusVGAState * s)
837 {
838     int need_update;
839  
840     s->vga.gr[0x31] &=
841         ~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
842     need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
843         || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
844     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
845     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
846     s->cirrus_srccounter = 0;
847     if (!need_update)
848         return;
849     cirrus_update_memory_access(s);
850 }
851  
852 static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
853 {
854     int w;
855  
856     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
857     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
858     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
859  
860     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
861         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
862             s->cirrus_blt_srcpitch = 8;
863         } else {
864             /* XXX: check for 24 bpp */
865             s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;
866         }
867         s->cirrus_srccounter = s->cirrus_blt_srcpitch;
868     } else {
869         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
870             w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;
871             if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)
872                 s->cirrus_blt_srcpitch = ((w + 31) >> 5);
873             else
874                 s->cirrus_blt_srcpitch = ((w + 7) >> 3);
875         } else {
876             /* always align input size to 32 bits */
877             s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;
878         }
879         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
880     }
881     s->cirrus_srcptr = s->cirrus_bltbuf;
882     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
883     cirrus_update_memory_access(s);
884     return 1;
885 }
886  
887 static int cirrus_bitblt_videotocpu(CirrusVGAState * s)
888 {
889     /* XXX */
890 #ifdef DEBUG_BITBLT
891     printf("cirrus: bitblt (video to cpu) is not implemented yet\n");
892 #endif
893     return 0;
894 }
895  
896 static int cirrus_bitblt_videotovideo(CirrusVGAState * s)
897 {
898     int ret;
899  
900     if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
901         ret = cirrus_bitblt_videotovideo_patterncopy(s);
902     } else {
903         ret = cirrus_bitblt_videotovideo_copy(s);
904     }
905     if (ret)
906         cirrus_bitblt_reset(s);
907     return ret;
908 }
909  
910 static void cirrus_bitblt_start(CirrusVGAState * s)
911 {
912     uint8_t blt_rop;
913  
914     s->vga.gr[0x31] |= CIRRUS_BLT_BUSY;
915  
916     s->cirrus_blt_width = (s->vga.gr[0x20] | (s->vga.gr[0x21] << 8)) + 1;
917     s->cirrus_blt_height = (s->vga.gr[0x22] | (s->vga.gr[0x23] << 8)) + 1;
918     s->cirrus_blt_dstpitch = (s->vga.gr[0x24] | (s->vga.gr[0x25] << 8));
919     s->cirrus_blt_srcpitch = (s->vga.gr[0x26] | (s->vga.gr[0x27] << 8));
920     s->cirrus_blt_dstaddr =
921         (s->vga.gr[0x28] | (s->vga.gr[0x29] << 8) | (s->vga.gr[0x2a] << 16));
922     s->cirrus_blt_srcaddr =
923         (s->vga.gr[0x2c] | (s->vga.gr[0x2d] << 8) | (s->vga.gr[0x2e] << 16));
924     s->cirrus_blt_mode = s->vga.gr[0x30];
925     s->cirrus_blt_modeext = s->vga.gr[0x33];
926     blt_rop = s->vga.gr[0x32];
927  
928 #ifdef DEBUG_BITBLT
929     printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n",
930            blt_rop,
931            s->cirrus_blt_mode,
932            s->cirrus_blt_modeext,
933            s->cirrus_blt_width,
934            s->cirrus_blt_height,
935            s->cirrus_blt_dstpitch,
936            s->cirrus_blt_srcpitch,
937            s->cirrus_blt_dstaddr,
938            s->cirrus_blt_srcaddr,
939            s->vga.gr[0x2f]);
940 #endif
941  
942     switch (s->cirrus_blt_mode & CIRRUS_BLTMODE_PIXELWIDTHMASK) {
943     case CIRRUS_BLTMODE_PIXELWIDTH8:
944         s->cirrus_blt_pixelwidth = 1;
945         break;
946     case CIRRUS_BLTMODE_PIXELWIDTH16:
947         s->cirrus_blt_pixelwidth = 2;
948         break;
949     case CIRRUS_BLTMODE_PIXELWIDTH24:
950         s->cirrus_blt_pixelwidth = 3;
951         break;
952     case CIRRUS_BLTMODE_PIXELWIDTH32:
953         s->cirrus_blt_pixelwidth = 4;
954         break;
955     default:
956 #ifdef DEBUG_BITBLT
957         printf("cirrus: bitblt - pixel width is unknown\n");
958 #endif
959         goto bitblt_ignore;
960     }
961     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_PIXELWIDTHMASK;
962  
963     if ((s->
964          cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSSRC |
965                             CIRRUS_BLTMODE_MEMSYSDEST))
966         == (CIRRUS_BLTMODE_MEMSYSSRC | CIRRUS_BLTMODE_MEMSYSDEST)) {
967 #ifdef DEBUG_BITBLT
968         printf("cirrus: bitblt - memory-to-memory copy is requested\n");
969 #endif
970         goto bitblt_ignore;
971     }
972  
973     if ((s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_SOLIDFILL) &&
974         (s->cirrus_blt_mode & (CIRRUS_BLTMODE_MEMSYSDEST |
975                                CIRRUS_BLTMODE_TRANSPARENTCOMP |
976                                CIRRUS_BLTMODE_PATTERNCOPY |
977                                CIRRUS_BLTMODE_COLOREXPAND)) ==
978          (CIRRUS_BLTMODE_PATTERNCOPY | CIRRUS_BLTMODE_COLOREXPAND)) {
979         cirrus_bitblt_fgcol(s);
980         cirrus_bitblt_solidfill(s, blt_rop);
981     } else {
982         if ((s->cirrus_blt_mode & (CIRRUS_BLTMODE_COLOREXPAND |
983                                    CIRRUS_BLTMODE_PATTERNCOPY)) ==
984             CIRRUS_BLTMODE_COLOREXPAND) {
985  
986             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
987                 if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
988                     cirrus_bitblt_bgcol(s);
989                 else
990                     cirrus_bitblt_fgcol(s);
991                 s->cirrus_rop = cirrus_colorexpand_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
992             } else {
993                 cirrus_bitblt_fgcol(s);
994                 cirrus_bitblt_bgcol(s);
995                 s->cirrus_rop = cirrus_colorexpand[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
996             }
997         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {
998             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {
999                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1000                     if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV)
1001                         cirrus_bitblt_bgcol(s);
1002                     else
1003                         cirrus_bitblt_fgcol(s);
1004                     s->cirrus_rop = cirrus_colorexpand_pattern_transp[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1005                 } else {
1006                     cirrus_bitblt_fgcol(s);
1007                     cirrus_bitblt_bgcol(s);
1008                     s->cirrus_rop = cirrus_colorexpand_pattern[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1009                 }
1010             } else {
1011                 s->cirrus_rop = cirrus_patternfill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1012             }
1013         } else {
1014             if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
1015                 if (s->cirrus_blt_pixelwidth > 2) {
1016                     printf("src transparent without colorexpand must be 8bpp or 16bpp\n");
1017                     goto bitblt_ignore;
1018                 }
1019                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1020                     s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1021                     s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1022                     s->cirrus_rop = cirrus_bkwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1023                 } else {
1024                     s->cirrus_rop = cirrus_fwd_transp_rop[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
1025                 }
1026             } else {
1027                 if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
1028                     s->cirrus_blt_dstpitch = -s->cirrus_blt_dstpitch;
1029                     s->cirrus_blt_srcpitch = -s->cirrus_blt_srcpitch;
1030                     s->cirrus_rop = cirrus_bkwd_rop[rop_to_index[blt_rop]];
1031                 } else {
1032                     s->cirrus_rop = cirrus_fwd_rop[rop_to_index[blt_rop]];
1033                 }
1034             }
1035         }
1036         // setup bitblt engine.
1037         if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSSRC) {
1038             if (!cirrus_bitblt_cputovideo(s))
1039                 goto bitblt_ignore;
1040         } else if (s->cirrus_blt_mode & CIRRUS_BLTMODE_MEMSYSDEST) {
1041             if (!cirrus_bitblt_videotocpu(s))
1042                 goto bitblt_ignore;
1043         } else {
1044             if (!cirrus_bitblt_videotovideo(s))
1045                 goto bitblt_ignore;
1046         }
1047     }
1048     return;
1049   bitblt_ignore:;
1050     cirrus_bitblt_reset(s);
1051 }
1052  
1053 static void cirrus_write_bitblt(CirrusVGAState * s, unsigned reg_value)
1054 {
1055     unsigned old_value;
1056  
1057     old_value = s->vga.gr[0x31];
1058     s->vga.gr[0x31] = reg_value;
1059  
1060     if (((old_value & CIRRUS_BLT_RESET) != 0) &&
1061         ((reg_value & CIRRUS_BLT_RESET) == 0)) {
1062         cirrus_bitblt_reset(s);
1063     } else if (((old_value & CIRRUS_BLT_START) == 0) &&
1064                ((reg_value & CIRRUS_BLT_START) != 0)) {
1065         cirrus_bitblt_start(s);
1066     }
1067 }
1068  
1069  
1070 /***************************************
1071  *
1072  *  basic parameters
1073  *
1074  ***************************************/
1075  
1076 static void cirrus_get_offsets(VGACommonState *s1,
1077                                uint32_t *pline_offset,
1078                                uint32_t *pstart_addr,
1079                                uint32_t *pline_compare)
1080 {
1081     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1082     uint32_t start_addr, line_offset, line_compare;
1083  
1084     line_offset = s->vga.cr[0x13]
1085         | ((s->vga.cr[0x1b] & 0x10) << 4);
1086     line_offset <<= 3;
1087     *pline_offset = line_offset;
1088  
1089     start_addr = (s->vga.cr[0x0c] << 8)
1090         | s->vga.cr[0x0d]
1091         | ((s->vga.cr[0x1b] & 0x01) << 16)
1092         | ((s->vga.cr[0x1b] & 0x0c) << 15)
1093         | ((s->vga.cr[0x1d] & 0x80) << 12);
1094     *pstart_addr = start_addr;
1095  
1096     line_compare = s->vga.cr[0x18] |
1097         ((s->vga.cr[0x07] & 0x10) << 4) |
1098         ((s->vga.cr[0x09] & 0x40) << 3);
1099     *pline_compare = line_compare;
1100 }
1101  
1102 static uint32_t cirrus_get_bpp16_depth(CirrusVGAState * s)
1103 {
1104     uint32_t ret = 16;
1105  
1106     switch (s->cirrus_hidden_dac_data & 0xf) {
1107     case 0:
1108         ret = 15;
1109         break;                  /* Sierra HiColor */
1110     case 1:
1111         ret = 16;
1112         break;                  /* XGA HiColor */
1113     default:
1114 #ifdef DEBUG_CIRRUS
1115         printf("cirrus: invalid DAC value %x in 16bpp\n",
1116                (s->cirrus_hidden_dac_data & 0xf));
1117 #endif
1118         ret = 15;               /* XXX */
1119         break;
1120     }
1121     return ret;
1122 }
1123  
1124 static int cirrus_get_bpp(VGACommonState *s1)
1125 {
1126     CirrusVGAState * s = container_of(s1, CirrusVGAState, vga);
1127     uint32_t ret = 8;
1128  
1129     if ((s->vga.sr[0x07] & 0x01) != 0) {
1130         /* Cirrus SVGA */
1131         switch (s->vga.sr[0x07] & CIRRUS_SR7_BPP_MASK) {
1132         case CIRRUS_SR7_BPP_8:
1133             ret = 8;
1134             break;
1135         case CIRRUS_SR7_BPP_16_DOUBLEVCLK:
1136             ret = cirrus_get_bpp16_depth(s);
1137             break;
1138         case CIRRUS_SR7_BPP_24:
1139             ret = 24;
1140             break;
1141         case CIRRUS_SR7_BPP_16:
1142             ret = cirrus_get_bpp16_depth(s);
1143             break;
1144         case CIRRUS_SR7_BPP_32:
1145             ret = 32;
1146             break;
1147         default:
1148 #ifdef DEBUG_CIRRUS
1149             printf("cirrus: unknown bpp - sr7=%x\n", s->vga.sr[0x7]);
1150 #endif
1151             ret = 8;
1152             break;
1153         }
1154     } else {
1155         /* VGA */
1156         ret = 0;
1157     }
1158  
1159     return ret;
1160 }
1161  
1162 static void cirrus_get_resolution(VGACommonState *s, int *pwidth, int *pheight)
1163 {
1164     int width, height;
1165  
1166     width = (s->cr[0x01] + 1) * 8;
1167     height = s->cr[0x12] |
1168         ((s->cr[0x07] & 0x02) << 7) |
1169         ((s->cr[0x07] & 0x40) << 3);
1170     height = (height + 1);
1171     /* interlace support */
1172     if (s->cr[0x1a] & 0x01)
1173         height = height * 2;
1174     *pwidth = width;
1175     *pheight = height;
1176 }
1177  
1178 /***************************************
1179  *
1180  * bank memory
1181  *
1182  ***************************************/
1183  
1184 static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
1185 {
1186     unsigned offset;
1187     unsigned limit;
1188  
1189     if ((s->vga.gr[0x0b] & 0x01) != 0)  /* dual bank */
1190         offset = s->vga.gr[0x09 + bank_index];
1191     else                        /* single bank */
1192         offset = s->vga.gr[0x09];
1193  
1194     if ((s->vga.gr[0x0b] & 0x20) != 0)
1195         offset <<= 14;
1196     else
1197         offset <<= 12;
1198  
1199     if (s->real_vram_size <= offset)
1200         limit = 0;
1201     else
1202         limit = s->real_vram_size - offset;
1203  
1204     if (((s->vga.gr[0x0b] & 0x01) == 0) && (bank_index != 0)) {
1205         if (limit > 0x8000) {
1206             offset += 0x8000;
1207             limit -= 0x8000;
1208         } else {
1209             limit = 0;
1210         }
1211     }
1212  
1213     if (limit > 0) {
1214         /* Thinking about changing bank base? First, drop the dirty bitmap information
1215          * on the current location, otherwise we lose this pointer forever */
1216         if (s->vga.lfb_vram_mapped) {
1217             target_phys_addr_t base_addr = isa_mem_base + 0xa0000 + bank_index * 0x8000;
1218             cpu_physical_sync_dirty_bitmap(base_addr, base_addr + 0x8000);
1219         }
1220         s->cirrus_bank_base[bank_index] = offset;
1221         s->cirrus_bank_limit[bank_index] = limit;
1222     } else {
1223         s->cirrus_bank_base[bank_index] = 0;
1224         s->cirrus_bank_limit[bank_index] = 0;
1225     }
1226 }
1227  
1228 /***************************************
1229  *
1230  *  I/O access between 0x3c4-0x3c5
1231  *
1232  ***************************************/
1233  
1234 static int cirrus_vga_read_sr(CirrusVGAState * s)
1235 {
1236     switch (s->vga.sr_index) {
1237     case 0x00:                  // Standard VGA
1238     case 0x01:                  // Standard VGA
1239     case 0x02:                  // Standard VGA
1240     case 0x03:                  // Standard VGA
1241     case 0x04:                  // Standard VGA
1242         return s->vga.sr[s->vga.sr_index];
1243     case 0x06:                  // Unlock Cirrus extensions
1244         return s->vga.sr[s->vga.sr_index];
1245     case 0x10:
1246     case 0x30:
1247     case 0x50:
1248     case 0x70:                  // Graphics Cursor X
1249     case 0x90:
1250     case 0xb0:
1251     case 0xd0:
1252     case 0xf0:                  // Graphics Cursor X
1253         return s->vga.sr[0x10];
1254     case 0x11:
1255     case 0x31:
1256     case 0x51:
1257     case 0x71:                  // Graphics Cursor Y
1258     case 0x91:
1259     case 0xb1:
1260     case 0xd1:
1261     case 0xf1:                  // Graphics Cursor Y
1262         return s->vga.sr[0x11];
1263     case 0x05:                  // ???
1264     case 0x07:                  // Extended Sequencer Mode
1265     case 0x08:                  // EEPROM Control
1266     case 0x09:                  // Scratch Register 0
1267     case 0x0a:                  // Scratch Register 1
1268     case 0x0b:                  // VCLK 0
1269     case 0x0c:                  // VCLK 1
1270     case 0x0d:                  // VCLK 2
1271     case 0x0e:                  // VCLK 3
1272     case 0x0f:                  // DRAM Control
1273     case 0x12:                  // Graphics Cursor Attribute
1274     case 0x13:                  // Graphics Cursor Pattern Address
1275     case 0x14:                  // Scratch Register 2
1276     case 0x15:                  // Scratch Register 3
1277     case 0x16:                  // Performance Tuning Register
1278     case 0x17:                  // Configuration Readback and Extended Control
1279     case 0x18:                  // Signature Generator Control
1280     case 0x19:                  // Signal Generator Result
1281     case 0x1a:                  // Signal Generator Result
1282     case 0x1b:                  // VCLK 0 Denominator & Post
1283     case 0x1c:                  // VCLK 1 Denominator & Post
1284     case 0x1d:                  // VCLK 2 Denominator & Post
1285     case 0x1e:                  // VCLK 3 Denominator & Post
1286     case 0x1f:                  // BIOS Write Enable and MCLK select
1287 #ifdef DEBUG_CIRRUS
1288         printf("cirrus: handled inport sr_index %02x\n", s->vga.sr_index);
1289 #endif
1290         return s->vga.sr[s->vga.sr_index];
1291     default:
1292 #ifdef DEBUG_CIRRUS
1293         printf("cirrus: inport sr_index %02x\n", s->vga.sr_index);
1294 #endif
1295         return 0xff;
1296         break;
1297     }
1298 }
1299  
1300 static void cirrus_vga_write_sr(CirrusVGAState * s, uint32_t val)
1301 {
1302     switch (s->vga.sr_index) {
1303     case 0x00:                  // Standard VGA
1304     case 0x01:                  // Standard VGA
1305     case 0x02:                  // Standard VGA
1306     case 0x03:                  // Standard VGA
1307     case 0x04:                  // Standard VGA
1308         s->vga.sr[s->vga.sr_index] = val & sr_mask[s->vga.sr_index];
1309         if (s->vga.sr_index == 1)
1310             s->vga.update_retrace_info(&s->vga);
1311         break;
1312     case 0x06:                  // Unlock Cirrus extensions
1313         val &= 0x17;
1314         if (val == 0x12) {
1315             s->vga.sr[s->vga.sr_index] = 0x12;
1316         } else {
1317             s->vga.sr[s->vga.sr_index] = 0x0f;
1318         }
1319         break;
1320     case 0x10:
1321     case 0x30:
1322     case 0x50:
1323     case 0x70:                  // Graphics Cursor X
1324     case 0x90:
1325     case 0xb0:
1326     case 0xd0:
1327     case 0xf0:                  // Graphics Cursor X
1328         s->vga.sr[0x10] = val;
1329         s->hw_cursor_x = (val << 3) | (s->vga.sr_index >> 5);
1330         break;
1331     case 0x11:
1332     case 0x31:
1333     case 0x51:
1334     case 0x71:                  // Graphics Cursor Y
1335     case 0x91:
1336     case 0xb1:
1337     case 0xd1:
1338     case 0xf1:                  // Graphics Cursor Y
1339         s->vga.sr[0x11] = val;
1340         s->hw_cursor_y = (val << 3) | (s->vga.sr_index >> 5);
1341         break;
1342     case 0x07:                  // Extended Sequencer Mode
1343     cirrus_update_memory_access(s);
1344     case 0x08:                  // EEPROM Control
1345     case 0x09:                  // Scratch Register 0
1346     case 0x0a:                  // Scratch Register 1
1347     case 0x0b:                  // VCLK 0
1348     case 0x0c:                  // VCLK 1
1349     case 0x0d:                  // VCLK 2
1350     case 0x0e:                  // VCLK 3
1351     case 0x0f:                  // DRAM Control
1352     case 0x12:                  // Graphics Cursor Attribute
1353     case 0x13:                  // Graphics Cursor Pattern Address
1354     case 0x14:                  // Scratch Register 2
1355     case 0x15:                  // Scratch Register 3
1356     case 0x16:                  // Performance Tuning Register
1357     case 0x18:                  // Signature Generator Control
1358     case 0x19:                  // Signature Generator Result
1359     case 0x1a:                  // Signature Generator Result
1360     case 0x1b:                  // VCLK 0 Denominator & Post
1361     case 0x1c:                  // VCLK 1 Denominator & Post
1362     case 0x1d:                  // VCLK 2 Denominator & Post
1363     case 0x1e:                  // VCLK 3 Denominator & Post
1364     case 0x1f:                  // BIOS Write Enable and MCLK select
1365         s->vga.sr[s->vga.sr_index] = val;
1366 #ifdef DEBUG_CIRRUS
1367         printf("cirrus: handled outport sr_index %02x, sr_value %02x\n",
1368                s->vga.sr_index, val);
1369 #endif
1370         break;
1371     case 0x17:                  // Configuration Readback and Extended Control
1372         s->vga.sr[s->vga.sr_index] = (s->vga.sr[s->vga.sr_index] & 0x38)
1373                                    | (val & 0xc7);
1374         cirrus_update_memory_access(s);
1375         break;
1376     default:
1377 #ifdef DEBUG_CIRRUS
1378         printf("cirrus: outport sr_index %02x, sr_value %02x\n",
1379                s->vga.sr_index, val);
1380 #endif
1381         break;
1382     }
1383 }
1384  
1385 /***************************************
1386  *
1387  *  I/O access at 0x3c6
1388  *
1389  ***************************************/
1390  
1391 static int cirrus_read_hidden_dac(CirrusVGAState * s)
1392 {
1393     if (++s->cirrus_hidden_dac_lockindex == 5) {
1394         s->cirrus_hidden_dac_lockindex = 0;
1395         return s->cirrus_hidden_dac_data;
1396     }
1397     return 0xff;
1398 }
1399  
1400 static void cirrus_write_hidden_dac(CirrusVGAState * s, int reg_value)
1401 {
1402     if (s->cirrus_hidden_dac_lockindex == 4) {
1403         s->cirrus_hidden_dac_data = reg_value;
1404 #if defined(DEBUG_CIRRUS)
1405         printf("cirrus: outport hidden DAC, value %02x\n", reg_value);
1406 #endif
1407     }
1408     s->cirrus_hidden_dac_lockindex = 0;
1409 }
1410  
1411 /***************************************
1412  *
1413  *  I/O access at 0x3c9
1414  *
1415  ***************************************/
1416  
1417 static int cirrus_vga_read_palette(CirrusVGAState * s)
1418 {
1419     int val;
1420  
1421     if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1422         val = s->cirrus_hidden_palette[(s->vga.dac_read_index & 0x0f) * 3 +
1423                                        s->vga.dac_sub_index];
1424     } else {
1425         val = s->vga.palette[s->vga.dac_read_index * 3 + s->vga.dac_sub_index];
1426     }
1427     if (++s->vga.dac_sub_index == 3) {
1428         s->vga.dac_sub_index = 0;
1429         s->vga.dac_read_index++;
1430     }
1431     return val;
1432 }
1433  
1434 static void cirrus_vga_write_palette(CirrusVGAState * s, int reg_value)
1435 {
1436     s->vga.dac_cache[s->vga.dac_sub_index] = reg_value;
1437     if (++s->vga.dac_sub_index == 3) {
1438         if ((s->vga.sr[0x12] & CIRRUS_CURSOR_HIDDENPEL)) {
1439             memcpy(&s->cirrus_hidden_palette[(s->vga.dac_write_index & 0x0f) * 3],
1440                    s->vga.dac_cache, 3);
1441         } else {
1442             memcpy(&s->vga.palette[s->vga.dac_write_index * 3], s->vga.dac_cache, 3);
1443         }
1444         /* XXX update cursor */
1445         s->vga.dac_sub_index = 0;
1446         s->vga.dac_write_index++;
1447     }
1448 }
1449  
1450 /***************************************
1451  *
1452  *  I/O access between 0x3ce-0x3cf
1453  *
1454  ***************************************/
1455  
1456 static int cirrus_vga_read_gr(CirrusVGAState * s, unsigned reg_index)
1457 {
1458     switch (reg_index) {
1459     case 0x00: // Standard VGA, BGCOLOR 0x000000ff
1460         return s->cirrus_shadow_gr0;
1461     case 0x01: // Standard VGA, FGCOLOR 0x000000ff
1462         return s->cirrus_shadow_gr1;
1463     case 0x02:                  // Standard VGA
1464     case 0x03:                  // Standard VGA
1465     case 0x04:                  // Standard VGA
1466     case 0x06:                  // Standard VGA
1467     case 0x07:                  // Standard VGA
1468     case 0x08:                  // Standard VGA
1469         return s->vga.gr[s->vga.gr_index];
1470     case 0x05:                  // Standard VGA, Cirrus extended mode
1471     default:
1472         break;
1473     }
1474  
1475     if (reg_index < 0x3a) {
1476         return s->vga.gr[reg_index];
1477     } else {
1478 #ifdef DEBUG_CIRRUS
1479         printf("cirrus: inport gr_index %02x\n", reg_index);
1480 #endif
1481         return 0xff;
1482     }
1483 }
1484  
1485 static void
1486 cirrus_vga_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
1487 {
1488 #if defined(DEBUG_BITBLT) && 0
1489     printf("gr%02x: %02x\n", reg_index, reg_value);
1490 #endif
1491     switch (reg_index) {
1492     case 0x00:                  // Standard VGA, BGCOLOR 0x000000ff
1493         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1494         s->cirrus_shadow_gr0 = reg_value;
1495         break;
1496     case 0x01:                  // Standard VGA, FGCOLOR 0x000000ff
1497         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1498         s->cirrus_shadow_gr1 = reg_value;
1499         break;
1500     case 0x02:                  // Standard VGA
1501     case 0x03:                  // Standard VGA
1502     case 0x04:                  // Standard VGA
1503     case 0x06:                  // Standard VGA
1504     case 0x07:                  // Standard VGA
1505     case 0x08:                  // Standard VGA
1506         s->vga.gr[reg_index] = reg_value & gr_mask[reg_index];
1507         break;
1508     case 0x05:                  // Standard VGA, Cirrus extended mode
1509         s->vga.gr[reg_index] = reg_value & 0x7f;
1510         cirrus_update_memory_access(s);
1511         break;
1512     case 0x09:                  // bank offset #0
1513     case 0x0A:                  // bank offset #1
1514         s->vga.gr[reg_index] = reg_value;
1515         cirrus_update_bank_ptr(s, 0);
1516         cirrus_update_bank_ptr(s, 1);
1517         cirrus_update_memory_access(s);
1518         break;
1519     case 0x0B:
1520         s->vga.gr[reg_index] = reg_value;
1521         cirrus_update_bank_ptr(s, 0);
1522         cirrus_update_bank_ptr(s, 1);
1523         cirrus_update_memory_access(s);
1524         break;
1525     case 0x10:                  // BGCOLOR 0x0000ff00
1526     case 0x11:                  // FGCOLOR 0x0000ff00
1527     case 0x12:                  // BGCOLOR 0x00ff0000
1528     case 0x13:                  // FGCOLOR 0x00ff0000
1529     case 0x14:                  // BGCOLOR 0xff000000
1530     case 0x15:                  // FGCOLOR 0xff000000
1531     case 0x20:                  // BLT WIDTH 0x0000ff
1532     case 0x22:                  // BLT HEIGHT 0x0000ff
1533     case 0x24:                  // BLT DEST PITCH 0x0000ff
1534     case 0x26:                  // BLT SRC PITCH 0x0000ff
1535     case 0x28:                  // BLT DEST ADDR 0x0000ff
1536     case 0x29:                  // BLT DEST ADDR 0x00ff00
1537     case 0x2c:                  // BLT SRC ADDR 0x0000ff
1538     case 0x2d:                  // BLT SRC ADDR 0x00ff00
1539     case 0x2f:                  // BLT WRITEMASK
1540     case 0x30:                  // BLT MODE
1541     case 0x32:                  // RASTER OP
1542     case 0x33:                  // BLT MODEEXT
1543     case 0x34:                  // BLT TRANSPARENT COLOR 0x00ff
1544     case 0x35:                  // BLT TRANSPARENT COLOR 0xff00
1545     case 0x38:                  // BLT TRANSPARENT COLOR MASK 0x00ff
1546     case 0x39:                  // BLT TRANSPARENT COLOR MASK 0xff00
1547         s->vga.gr[reg_index] = reg_value;
1548         break;
1549     case 0x21:                  // BLT WIDTH 0x001f00
1550     case 0x23:                  // BLT HEIGHT 0x001f00
1551     case 0x25:                  // BLT DEST PITCH 0x001f00
1552     case 0x27:                  // BLT SRC PITCH 0x001f00
1553         s->vga.gr[reg_index] = reg_value & 0x1f;
1554         break;
1555     case 0x2a:                  // BLT DEST ADDR 0x3f0000
1556         s->vga.gr[reg_index] = reg_value & 0x3f;
1557         /* if auto start mode, starts bit blt now */
1558         if (s->vga.gr[0x31] & CIRRUS_BLT_AUTOSTART) {
1559             cirrus_bitblt_start(s);
1560         }
1561         break;
1562     case 0x2e:                  // BLT SRC ADDR 0x3f0000
1563         s->vga.gr[reg_index] = reg_value & 0x3f;
1564         break;
1565     case 0x31:                  // BLT STATUS/START
1566         cirrus_write_bitblt(s, reg_value);
1567         break;
1568     default:
1569 #ifdef DEBUG_CIRRUS
1570         printf("cirrus: outport gr_index %02x, gr_value %02x\n", reg_index,
1571                reg_value);
1572 #endif
1573         break;
1574     }
1575 }
1576  
1577 /***************************************
1578  *
1579  *  I/O access between 0x3d4-0x3d5
1580  *
1581  ***************************************/
1582  
1583 static int cirrus_vga_read_cr(CirrusVGAState * s, unsigned reg_index)
1584 {
1585     switch (reg_index) {
1586     case 0x00:                  // Standard VGA
1587     case 0x01:                  // Standard VGA
1588     case 0x02:                  // Standard VGA
1589     case 0x03:                  // Standard VGA
1590     case 0x04:                  // Standard VGA
1591     case 0x05:                  // Standard VGA
1592     case 0x06:                  // Standard VGA
1593     case 0x07:                  // Standard VGA
1594     case 0x08:                  // Standard VGA
1595     case 0x09:                  // Standard VGA
1596     case 0x0a:                  // Standard VGA
1597     case 0x0b:                  // Standard VGA
1598     case 0x0c:                  // Standard VGA
1599     case 0x0d:                  // Standard VGA
1600     case 0x0e:                  // Standard VGA
1601     case 0x0f:                  // Standard VGA
1602     case 0x10:                  // Standard VGA
1603     case 0x11:                  // Standard VGA
1604     case 0x12:                  // Standard VGA
1605     case 0x13:                  // Standard VGA
1606     case 0x14:                  // Standard VGA
1607     case 0x15:                  // Standard VGA
1608     case 0x16:                  // Standard VGA
1609     case 0x17:                  // Standard VGA
1610     case 0x18:                  // Standard VGA
1611         return s->vga.cr[s->vga.cr_index];
1612     case 0x24:                  // Attribute Controller Toggle Readback (R)
1613         return (s->vga.ar_flip_flop << 7);
1614     case 0x19:                  // Interlace End
1615     case 0x1a:                  // Miscellaneous Control
1616     case 0x1b:                  // Extended Display Control
1617     case 0x1c:                  // Sync Adjust and Genlock
1618     case 0x1d:                  // Overlay Extended Control
1619     case 0x22:                  // Graphics Data Latches Readback (R)
1620     case 0x25:                  // Part Status
1621     case 0x27:                  // Part ID (R)
1622         return s->vga.cr[s->vga.cr_index];
1623     case 0x26:                  // Attribute Controller Index Readback (R)
1624         return s->vga.ar_index & 0x3f;
1625         break;
1626     default:
1627 #ifdef DEBUG_CIRRUS
1628         printf("cirrus: inport cr_index %02x\n", reg_index);
1629 #endif
1630         return 0xff;
1631     }
1632 }
1633  
1634 static void cirrus_vga_write_cr(CirrusVGAState * s, int reg_value)
1635 {
1636     switch (s->vga.cr_index) {
1637     case 0x00:                  // Standard VGA
1638     case 0x01:                  // Standard VGA
1639     case 0x02:                  // Standard VGA
1640     case 0x03:                  // Standard VGA
1641     case 0x04:                  // Standard VGA
1642     case 0x05:                  // Standard VGA
1643     case 0x06:                  // Standard VGA
1644     case 0x07:                  // Standard VGA
1645     case 0x08:                  // Standard VGA
1646     case 0x09:                  // Standard VGA
1647     case 0x0a:                  // Standard VGA
1648     case 0x0b:                  // Standard VGA
1649     case 0x0c:                  // Standard VGA
1650     case 0x0d:                  // Standard VGA
1651     case 0x0e:                  // Standard VGA
1652     case 0x0f:                  // Standard VGA
1653     case 0x10:                  // Standard VGA
1654     case 0x11:                  // Standard VGA
1655     case 0x12:                  // Standard VGA
1656     case 0x13:                  // Standard VGA
1657     case 0x14:                  // Standard VGA
1658     case 0x15:                  // Standard VGA
1659     case 0x16:                  // Standard VGA
1660     case 0x17:                  // Standard VGA
1661     case 0x18:                  // Standard VGA
1662         /* handle CR0-7 protection */
1663         if ((s->vga.cr[0x11] & 0x80) && s->vga.cr_index <= 7) {
1664             /* can always write bit 4 of CR7 */
1665             if (s->vga.cr_index == 7)
1666                 s->vga.cr[7] = (s->vga.cr[7] & ~0x10) | (reg_value & 0x10);
1667             return;
1668         }
1669         s->vga.cr[s->vga.cr_index] = reg_value;
1670         switch(s->vga.cr_index) {
1671         case 0x00:
1672         case 0x04:
1673         case 0x05:
1674         case 0x06:
1675         case 0x07:
1676         case 0x11:
1677         case 0x17:
1678             s->vga.update_retrace_info(&s->vga);
1679             break;
1680         }
1681         break;
1682     case 0x19:                  // Interlace End
1683     case 0x1a:                  // Miscellaneous Control
1684     case 0x1b:                  // Extended Display Control
1685     case 0x1c:                  // Sync Adjust and Genlock
1686     case 0x1d:                  // Overlay Extended Control
1687         s->vga.cr[s->vga.cr_index] = reg_value;
1688 #ifdef DEBUG_CIRRUS
1689         printf("cirrus: handled outport cr_index %02x, cr_value %02x\n",
1690                s->vga.cr_index, reg_value);
1691 #endif
1692         break;
1693     case 0x22:                  // Graphics Data Latches Readback (R)
1694     case 0x24:                  // Attribute Controller Toggle Readback (R)
1695     case 0x26:                  // Attribute Controller Index Readback (R)
1696     case 0x27:                  // Part ID (R)
1697         break;
1698     case 0x25:                  // Part Status
1699     default:
1700 #ifdef DEBUG_CIRRUS
1701         printf("cirrus: outport cr_index %02x, cr_value %02x\n",
1702                s->vga.cr_index, reg_value);
1703 #endif
1704         break;
1705     }
1706 }
1707  
1708 /***************************************
1709  *
1710  *  memory-mapped I/O (bitblt)
1711  *
1712  ***************************************/
1713  
1714 static uint8_t cirrus_mmio_blt_read(CirrusVGAState * s, unsigned address)
1715 {
1716     int value = 0xff;
1717  
1718     switch (address) {
1719     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1720         value = cirrus_vga_read_gr(s, 0x00);
1721         break;
1722     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1723         value = cirrus_vga_read_gr(s, 0x10);
1724         break;
1725     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1726         value = cirrus_vga_read_gr(s, 0x12);
1727         break;
1728     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1729         value = cirrus_vga_read_gr(s, 0x14);
1730         break;
1731     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1732         value = cirrus_vga_read_gr(s, 0x01);
1733         break;
1734     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1735         value = cirrus_vga_read_gr(s, 0x11);
1736         break;
1737     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1738         value = cirrus_vga_read_gr(s, 0x13);
1739         break;
1740     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1741         value = cirrus_vga_read_gr(s, 0x15);
1742         break;
1743     case (CIRRUS_MMIO_BLTWIDTH + 0):
1744         value = cirrus_vga_read_gr(s, 0x20);
1745         break;
1746     case (CIRRUS_MMIO_BLTWIDTH + 1):
1747         value = cirrus_vga_read_gr(s, 0x21);
1748         break;
1749     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1750         value = cirrus_vga_read_gr(s, 0x22);
1751         break;
1752     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1753         value = cirrus_vga_read_gr(s, 0x23);
1754         break;
1755     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1756         value = cirrus_vga_read_gr(s, 0x24);
1757         break;
1758     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1759         value = cirrus_vga_read_gr(s, 0x25);
1760         break;
1761     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1762         value = cirrus_vga_read_gr(s, 0x26);
1763         break;
1764     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1765         value = cirrus_vga_read_gr(s, 0x27);
1766         break;
1767     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1768         value = cirrus_vga_read_gr(s, 0x28);
1769         break;
1770     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1771         value = cirrus_vga_read_gr(s, 0x29);
1772         break;
1773     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1774         value = cirrus_vga_read_gr(s, 0x2a);
1775         break;
1776     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1777         value = cirrus_vga_read_gr(s, 0x2c);
1778         break;
1779     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1780         value = cirrus_vga_read_gr(s, 0x2d);
1781         break;
1782     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1783         value = cirrus_vga_read_gr(s, 0x2e);
1784         break;
1785     case CIRRUS_MMIO_BLTWRITEMASK:
1786         value = cirrus_vga_read_gr(s, 0x2f);
1787         break;
1788     case CIRRUS_MMIO_BLTMODE:
1789         value = cirrus_vga_read_gr(s, 0x30);
1790         break;
1791     case CIRRUS_MMIO_BLTROP:
1792         value = cirrus_vga_read_gr(s, 0x32);
1793         break;
1794     case CIRRUS_MMIO_BLTMODEEXT:
1795         value = cirrus_vga_read_gr(s, 0x33);
1796         break;
1797     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1798         value = cirrus_vga_read_gr(s, 0x34);
1799         break;
1800     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1801         value = cirrus_vga_read_gr(s, 0x35);
1802         break;
1803     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1804         value = cirrus_vga_read_gr(s, 0x38);
1805         break;
1806     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1807         value = cirrus_vga_read_gr(s, 0x39);
1808         break;
1809     case CIRRUS_MMIO_BLTSTATUS:
1810         value = cirrus_vga_read_gr(s, 0x31);
1811         break;
1812     default:
1813 #ifdef DEBUG_CIRRUS
1814         printf("cirrus: mmio read - address 0x%04x\n", address);
1815 #endif
1816         break;
1817     }
1818  
1819     return (uint8_t) value;
1820 }
1821  
1822 static void cirrus_mmio_blt_write(CirrusVGAState * s, unsigned address,
1823                                   uint8_t value)
1824 {
1825     switch (address) {
1826     case (CIRRUS_MMIO_BLTBGCOLOR + 0):
1827         cirrus_vga_write_gr(s, 0x00, value);
1828         break;
1829     case (CIRRUS_MMIO_BLTBGCOLOR + 1):
1830         cirrus_vga_write_gr(s, 0x10, value);
1831         break;
1832     case (CIRRUS_MMIO_BLTBGCOLOR + 2):
1833         cirrus_vga_write_gr(s, 0x12, value);
1834         break;
1835     case (CIRRUS_MMIO_BLTBGCOLOR + 3):
1836         cirrus_vga_write_gr(s, 0x14, value);
1837         break;
1838     case (CIRRUS_MMIO_BLTFGCOLOR + 0):
1839         cirrus_vga_write_gr(s, 0x01, value);
1840         break;
1841     case (CIRRUS_MMIO_BLTFGCOLOR + 1):
1842         cirrus_vga_write_gr(s, 0x11, value);
1843         break;
1844     case (CIRRUS_MMIO_BLTFGCOLOR + 2):
1845         cirrus_vga_write_gr(s, 0x13, value);
1846         break;
1847     case (CIRRUS_MMIO_BLTFGCOLOR + 3):
1848         cirrus_vga_write_gr(s, 0x15, value);
1849         break;
1850     case (CIRRUS_MMIO_BLTWIDTH + 0):
1851         cirrus_vga_write_gr(s, 0x20, value);
1852         break;
1853     case (CIRRUS_MMIO_BLTWIDTH + 1):
1854         cirrus_vga_write_gr(s, 0x21, value);
1855         break;
1856     case (CIRRUS_MMIO_BLTHEIGHT + 0):
1857         cirrus_vga_write_gr(s, 0x22, value);
1858         break;
1859     case (CIRRUS_MMIO_BLTHEIGHT + 1):
1860         cirrus_vga_write_gr(s, 0x23, value);
1861         break;
1862     case (CIRRUS_MMIO_BLTDESTPITCH + 0):
1863         cirrus_vga_write_gr(s, 0x24, value);
1864         break;
1865     case (CIRRUS_MMIO_BLTDESTPITCH + 1):
1866         cirrus_vga_write_gr(s, 0x25, value);
1867         break;
1868     case (CIRRUS_MMIO_BLTSRCPITCH + 0):
1869         cirrus_vga_write_gr(s, 0x26, value);
1870         break;
1871     case (CIRRUS_MMIO_BLTSRCPITCH + 1):
1872         cirrus_vga_write_gr(s, 0x27, value);
1873         break;
1874     case (CIRRUS_MMIO_BLTDESTADDR + 0):
1875         cirrus_vga_write_gr(s, 0x28, value);
1876         break;
1877     case (CIRRUS_MMIO_BLTDESTADDR + 1):
1878         cirrus_vga_write_gr(s, 0x29, value);
1879         break;
1880     case (CIRRUS_MMIO_BLTDESTADDR + 2):
1881         cirrus_vga_write_gr(s, 0x2a, value);
1882         break;
1883     case (CIRRUS_MMIO_BLTDESTADDR + 3):
1884         /* ignored */
1885         break;
1886     case (CIRRUS_MMIO_BLTSRCADDR + 0):
1887         cirrus_vga_write_gr(s, 0x2c, value);
1888         break;
1889     case (CIRRUS_MMIO_BLTSRCADDR + 1):
1890         cirrus_vga_write_gr(s, 0x2d, value);
1891         break;
1892     case (CIRRUS_MMIO_BLTSRCADDR + 2):
1893         cirrus_vga_write_gr(s, 0x2e, value);
1894         break;
1895     case CIRRUS_MMIO_BLTWRITEMASK:
1896         cirrus_vga_write_gr(s, 0x2f, value);
1897         break;
1898     case CIRRUS_MMIO_BLTMODE:
1899         cirrus_vga_write_gr(s, 0x30, value);
1900         break;
1901     case CIRRUS_MMIO_BLTROP:
1902         cirrus_vga_write_gr(s, 0x32, value);
1903         break;
1904     case CIRRUS_MMIO_BLTMODEEXT:
1905         cirrus_vga_write_gr(s, 0x33, value);
1906         break;
1907     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 0):
1908         cirrus_vga_write_gr(s, 0x34, value);
1909         break;
1910     case (CIRRUS_MMIO_BLTTRANSPARENTCOLOR + 1):
1911         cirrus_vga_write_gr(s, 0x35, value);
1912         break;
1913     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 0):
1914         cirrus_vga_write_gr(s, 0x38, value);
1915         break;
1916     case (CIRRUS_MMIO_BLTTRANSPARENTCOLORMASK + 1):
1917         cirrus_vga_write_gr(s, 0x39, value);
1918         break;
1919     case CIRRUS_MMIO_BLTSTATUS:
1920         cirrus_vga_write_gr(s, 0x31, value);
1921         break;
1922     default:
1923 #ifdef DEBUG_CIRRUS
1924         printf("cirrus: mmio write - addr 0x%04x val 0x%02x (ignored)\n",
1925                address, value);
1926 #endif
1927         break;
1928     }
1929 }
1930  
1931 /***************************************
1932  *
1933  *  write mode 4/5
1934  *
1935  * assume TARGET_PAGE_SIZE >= 16
1936  *
1937  ***************************************/
1938  
1939 static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
1940                                              unsigned mode,
1941                                              unsigned offset,
1942                                              uint32_t mem_value)
1943 {
1944     int x;
1945     unsigned val = mem_value;
1946     uint8_t *dst;
1947  
1948     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1949     for (x = 0; x < 8; x++) {
1950         if (val & 0x80) {
1951             *dst = s->cirrus_shadow_gr1;
1952         } else if (mode == 5) {
1953             *dst = s->cirrus_shadow_gr0;
1954         }
1955         val <<= 1;
1956         dst++;
1957     }
1958     cpu_physical_memory_set_dirty(s->vga.vram_offset + offset);
1959     cpu_physical_memory_set_dirty(s->vga.vram_offset + offset + 7);
1960 }
1961  
1962 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
1963                                               unsigned mode,
1964                                               unsigned offset,
1965                                               uint32_t mem_value)
1966 {
1967     int x;
1968     unsigned val = mem_value;
1969     uint8_t *dst;
1970  
1971     dst = s->vga.vram_ptr + (offset &= s->cirrus_addr_mask);
1972     for (x = 0; x < 8; x++) {
1973         if (val & 0x80) {
1974             *dst = s->cirrus_shadow_gr1;
1975             *(dst + 1) = s->vga.gr[0x11];
1976         } else if (mode == 5) {
1977             *dst = s->cirrus_shadow_gr0;
1978             *(dst + 1) = s->vga.gr[0x10];
1979         }
1980         val <<= 1;
1981         dst += 2;
1982     }
1983     cpu_physical_memory_set_dirty(s->vga.vram_offset + offset);
1984     cpu_physical_memory_set_dirty(s->vga.vram_offset + offset + 15);
1985 }
1986  
1987 /***************************************
1988  *
1989  *  memory access between 0xa0000-0xbffff
1990  *
1991  ***************************************/
1992  
1993 static uint32_t cirrus_vga_mem_readb(void *opaque, target_phys_addr_t addr)
1994 {
1995     CirrusVGAState *s = opaque;
1996     unsigned bank_index;
1997     unsigned bank_offset;
1998     uint32_t val;
1999  
2000     if ((s->vga.sr[0x07] & 0x01) == 0) {
2001         return vga_mem_readb(s, addr);
2002     }
2003  
2004     addr &= 0x1ffff;
2005  
2006     if (addr < 0x10000) {
2007         /* XXX handle bitblt */
2008         /* video memory */
2009         bank_index = addr >> 15;
2010         bank_offset = addr & 0x7fff;
2011         if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2012             bank_offset += s->cirrus_bank_base[bank_index];
2013             if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2014                 bank_offset <<= 4;
2015             } else if (s->vga.gr[0x0B] & 0x02) {
2016                 bank_offset <<= 3;
2017             }
2018             bank_offset &= s->cirrus_addr_mask;
2019             val = *(s->vga.vram_ptr + bank_offset);
2020         } else
2021             val = 0xff;
2022     } else if (addr >= 0x18000 && addr < 0x18100) {
2023         /* memory-mapped I/O */
2024         val = 0xff;
2025         if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2026             val = cirrus_mmio_blt_read(s, addr & 0xff);
2027         }
2028     } else {
2029         val = 0xff;
2030 #ifdef DEBUG_CIRRUS
2031         printf("cirrus: mem_readb " TARGET_FMT_plx "\n", addr);
2032 #endif
2033     }
2034     return val;
2035 }
2036  
2037 static uint32_t cirrus_vga_mem_readw(void *opaque, target_phys_addr_t addr)
2038 {
2039     uint32_t v;
2040 #ifdef TARGET_WORDS_BIGENDIAN
2041     v = cirrus_vga_mem_readb(opaque, addr) << 8;
2042     v |= cirrus_vga_mem_readb(opaque, addr + 1);
2043 #else
2044     v = cirrus_vga_mem_readb(opaque, addr);
2045     v |= cirrus_vga_mem_readb(opaque, addr + 1) << 8;
2046 #endif
2047     return v;
2048 }
2049  
2050 static uint32_t cirrus_vga_mem_readl(void *opaque, target_phys_addr_t addr)
2051 {
2052     uint32_t v;
2053 #ifdef TARGET_WORDS_BIGENDIAN
2054     v = cirrus_vga_mem_readb(opaque, addr) << 24;
2055     v |= cirrus_vga_mem_readb(opaque, addr + 1) << 16;
2056     v |= cirrus_vga_mem_readb(opaque, addr + 2) << 8;
2057     v |= cirrus_vga_mem_readb(opaque, addr + 3);
2058 #else
2059     v = cirrus_vga_mem_readb(opaque, addr);
2060     v |= cirrus_vga_mem_readb(opaque, addr + 1) << 8;
2061     v |= cirrus_vga_mem_readb(opaque, addr + 2) << 16;
2062     v |= cirrus_vga_mem_readb(opaque, addr + 3) << 24;
2063 #endif
2064     return v;
2065 }
2066  
2067 static void cirrus_vga_mem_writeb(void *opaque, target_phys_addr_t addr,
2068                                   uint32_t mem_value)
2069 {
2070     CirrusVGAState *s = opaque;
2071     unsigned bank_index;
2072     unsigned bank_offset;
2073     unsigned mode;
2074  
2075     if ((s->vga.sr[0x07] & 0x01) == 0) {
2076         vga_mem_writeb(s, addr, mem_value);
2077         return;
2078     }
2079  
2080     addr &= 0x1ffff;
2081  
2082     if (addr < 0x10000) {
2083         if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2084             /* bitblt */
2085             *s->cirrus_srcptr++ = (uint8_t) mem_value;
2086             if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2087                 cirrus_bitblt_cputovideo_next(s);
2088             }
2089         } else {
2090             /* video memory */
2091             bank_index = addr >> 15;
2092             bank_offset = addr & 0x7fff;
2093             if (bank_offset < s->cirrus_bank_limit[bank_index]) {
2094                 bank_offset += s->cirrus_bank_base[bank_index];
2095                 if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2096                     bank_offset <<= 4;
2097                 } else if (s->vga.gr[0x0B] & 0x02) {
2098                     bank_offset <<= 3;
2099                 }
2100                 bank_offset &= s->cirrus_addr_mask;
2101                 mode = s->vga.gr[0x05] & 0x7;
2102                 if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2103                     *(s->vga.vram_ptr + bank_offset) = mem_value;
2104                     cpu_physical_memory_set_dirty(s->vga.vram_offset +
2105                                                   bank_offset);
2106                 } else {
2107                     if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2108                         cirrus_mem_writeb_mode4and5_8bpp(s, mode,
2109                                                          bank_offset,
2110                                                          mem_value);
2111                     } else {
2112                         cirrus_mem_writeb_mode4and5_16bpp(s, mode,
2113                                                           bank_offset,
2114                                                           mem_value);
2115                     }
2116                 }
2117             }
2118         }
2119     } else if (addr >= 0x18000 && addr < 0x18100) {
2120         /* memory-mapped I/O */
2121         if ((s->vga.sr[0x17] & 0x44) == 0x04) {
2122             cirrus_mmio_blt_write(s, addr & 0xff, mem_value);
2123         }
2124     } else {
2125 #ifdef DEBUG_CIRRUS
2126         printf("cirrus: mem_writeb " TARGET_FMT_plx " value %02x\n", addr,
2127                mem_value);
2128 #endif
2129     }
2130 }
2131  
2132 static void cirrus_vga_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2133 {
2134 #ifdef TARGET_WORDS_BIGENDIAN
2135     cirrus_vga_mem_writeb(opaque, addr, (val >> 8) & 0xff);
2136     cirrus_vga_mem_writeb(opaque, addr + 1, val & 0xff);
2137 #else
2138     cirrus_vga_mem_writeb(opaque, addr, val & 0xff);
2139     cirrus_vga_mem_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2140 #endif
2141 }
2142  
2143 static void cirrus_vga_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2144 {
2145 #ifdef TARGET_WORDS_BIGENDIAN
2146     cirrus_vga_mem_writeb(opaque, addr, (val >> 24) & 0xff);
2147     cirrus_vga_mem_writeb(opaque, addr + 1, (val >> 16) & 0xff);
2148     cirrus_vga_mem_writeb(opaque, addr + 2, (val >> 8) & 0xff);
2149     cirrus_vga_mem_writeb(opaque, addr + 3, val & 0xff);
2150 #else
2151     cirrus_vga_mem_writeb(opaque, addr, val & 0xff);
2152     cirrus_vga_mem_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2153     cirrus_vga_mem_writeb(opaque, addr + 2, (val >> 16) & 0xff);
2154     cirrus_vga_mem_writeb(opaque, addr + 3, (val >> 24) & 0xff);
2155 #endif
2156 }
2157  
2158 static CPUReadMemoryFunc * const cirrus_vga_mem_read[3] = {
2159     cirrus_vga_mem_readb,
2160     cirrus_vga_mem_readw,
2161     cirrus_vga_mem_readl,
2162 };
2163  
2164 static CPUWriteMemoryFunc * const cirrus_vga_mem_write[3] = {
2165     cirrus_vga_mem_writeb,
2166     cirrus_vga_mem_writew,
2167     cirrus_vga_mem_writel,
2168 };
2169  
2170 /***************************************
2171  *
2172  *  hardware cursor
2173  *
2174  ***************************************/
2175  
2176 static inline void invalidate_cursor1(CirrusVGAState *s)
2177 {
2178     if (s->last_hw_cursor_size) {
2179         vga_invalidate_scanlines(&s->vga,
2180                                  s->last_hw_cursor_y + s->last_hw_cursor_y_start,
2181                                  s->last_hw_cursor_y + s->last_hw_cursor_y_end);
2182     }
2183 }
2184  
2185 static inline void cirrus_cursor_compute_yrange(CirrusVGAState *s)
2186 {
2187     const uint8_t *src;
2188     uint32_t content;
2189     int y, y_min, y_max;
2190  
2191     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2192     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2193         src += (s->vga.sr[0x13] & 0x3c) * 256;
2194         y_min = 64;
2195         y_max = -1;
2196         for(y = 0; y < 64; y++) {
2197             content = ((uint32_t *)src)[0] |
2198                 ((uint32_t *)src)[1] |
2199                 ((uint32_t *)src)[2] |
2200                 ((uint32_t *)src)[3];
2201             if (content) {
2202                 if (y < y_min)
2203                     y_min = y;
2204                 if (y > y_max)
2205                     y_max = y;
2206             }
2207             src += 16;
2208         }
2209     } else {
2210         src += (s->vga.sr[0x13] & 0x3f) * 256;
2211         y_min = 32;
2212         y_max = -1;
2213         for(y = 0; y < 32; y++) {
2214             content = ((uint32_t *)src)[0] |
2215                 ((uint32_t *)(src + 128))[0];
2216             if (content) {
2217                 if (y < y_min)
2218                     y_min = y;
2219                 if (y > y_max)
2220                     y_max = y;
2221             }
2222             src += 4;
2223         }
2224     }
2225     if (y_min > y_max) {
2226         s->last_hw_cursor_y_start = 0;
2227         s->last_hw_cursor_y_end = 0;
2228     } else {
2229         s->last_hw_cursor_y_start = y_min;
2230         s->last_hw_cursor_y_end = y_max + 1;
2231     }
2232 }
2233  
2234 /* NOTE: we do not currently handle the cursor bitmap change, so we
2235    update the cursor only if it moves. */
2236 static void cirrus_cursor_invalidate(VGACommonState *s1)
2237 {
2238     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2239     int size;
2240  
2241     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW)) {
2242         size = 0;
2243     } else {
2244         if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE)
2245             size = 64;
2246         else
2247             size = 32;
2248     }
2249     /* invalidate last cursor and new cursor if any change */
2250     if (s->last_hw_cursor_size != size ||
2251         s->last_hw_cursor_x != s->hw_cursor_x ||
2252         s->last_hw_cursor_y != s->hw_cursor_y) {
2253  
2254         invalidate_cursor1(s);
2255  
2256         s->last_hw_cursor_size = size;
2257         s->last_hw_cursor_x = s->hw_cursor_x;
2258         s->last_hw_cursor_y = s->hw_cursor_y;
2259         /* compute the real cursor min and max y */
2260         cirrus_cursor_compute_yrange(s);
2261         invalidate_cursor1(s);
2262     }
2263 }
2264  
2265 static void cirrus_cursor_draw_line(VGACommonState *s1, uint8_t *d1, int scr_y)
2266 {
2267     CirrusVGAState *s = container_of(s1, CirrusVGAState, vga);
2268     int w, h, bpp, x1, x2, poffset;
2269     unsigned int color0, color1;
2270     const uint8_t *palette, *src;
2271     uint32_t content;
2272  
2273     if (!(s->vga.sr[0x12] & CIRRUS_CURSOR_SHOW))
2274         return;
2275     /* fast test to see if the cursor intersects with the scan line */
2276     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2277         h = 64;
2278     } else {
2279         h = 32;
2280     }
2281     if (scr_y < s->hw_cursor_y ||
2282         scr_y >= (s->hw_cursor_y + h))
2283         return;
2284  
2285     src = s->vga.vram_ptr + s->real_vram_size - 16 * 1024;
2286     if (s->vga.sr[0x12] & CIRRUS_CURSOR_LARGE) {
2287         src += (s->vga.sr[0x13] & 0x3c) * 256;
2288         src += (scr_y - s->hw_cursor_y) * 16;
2289         poffset = 8;
2290         content = ((uint32_t *)src)[0] |
2291             ((uint32_t *)src)[1] |
2292             ((uint32_t *)src)[2] |
2293             ((uint32_t *)src)[3];
2294     } else {
2295         src += (s->vga.sr[0x13] & 0x3f) * 256;
2296         src += (scr_y - s->hw_cursor_y) * 4;
2297         poffset = 128;
2298         content = ((uint32_t *)src)[0] |
2299             ((uint32_t *)(src + 128))[0];
2300     }
2301     /* if nothing to draw, no need to continue */
2302     if (!content)
2303         return;
2304     w = h;
2305  
2306     x1 = s->hw_cursor_x;
2307     if (x1 >= s->vga.last_scr_width)
2308         return;
2309     x2 = s->hw_cursor_x + w;
2310     if (x2 > s->vga.last_scr_width)
2311         x2 = s->vga.last_scr_width;
2312     w = x2 - x1;
2313     palette = s->cirrus_hidden_palette;
2314     color0 = s->vga.rgb_to_pixel(c6_to_8(palette[0x0 * 3]),
2315                                  c6_to_8(palette[0x0 * 3 + 1]),
2316                                  c6_to_8(palette[0x0 * 3 + 2]));
2317     color1 = s->vga.rgb_to_pixel(c6_to_8(palette[0xf * 3]),
2318                                  c6_to_8(palette[0xf * 3 + 1]),
2319                                  c6_to_8(palette[0xf * 3 + 2]));
2320     bpp = ((ds_get_bits_per_pixel(s->vga.ds) + 7) >> 3);
2321     d1 += x1 * bpp;
2322     switch(ds_get_bits_per_pixel(s->vga.ds)) {
2323     default:
2324         break;
2325     case 8:
2326         vga_draw_cursor_line_8(d1, src, poffset, w, color0, color1, 0xff);
2327         break;
2328     case 15:
2329         vga_draw_cursor_line_16(d1, src, poffset, w, color0, color1, 0x7fff);
2330         break;
2331     case 16:
2332         vga_draw_cursor_line_16(d1, src, poffset, w, color0, color1, 0xffff);
2333         break;
2334     case 32:
2335         vga_draw_cursor_line_32(d1, src, poffset, w, color0, color1, 0xffffff);
2336         break;
2337     }
2338 }
2339  
2340 /***************************************
2341  *
2342  *  LFB memory access
2343  *
2344  ***************************************/
2345  
2346 static uint32_t cirrus_linear_readb(void *opaque, target_phys_addr_t addr)
2347 {
2348     CirrusVGAState *s = opaque;
2349     uint32_t ret;
2350  
2351     addr &= s->cirrus_addr_mask;
2352  
2353     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2354         ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {
2355         /* memory-mapped I/O */
2356         ret = cirrus_mmio_blt_read(s, addr & 0xff);
2357     } else if (0) {
2358         /* XXX handle bitblt */
2359         ret = 0xff;
2360     } else {
2361         /* video memory */
2362         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2363             addr <<= 4;
2364         } else if (s->vga.gr[0x0B] & 0x02) {
2365             addr <<= 3;
2366         }
2367         addr &= s->cirrus_addr_mask;
2368         ret = *(s->vga.vram_ptr + addr);
2369     }
2370  
2371     return ret;
2372 }
2373  
2374 static uint32_t cirrus_linear_readw(void *opaque, target_phys_addr_t addr)
2375 {
2376     uint32_t v;
2377 #ifdef TARGET_WORDS_BIGENDIAN
2378     v = cirrus_linear_readb(opaque, addr) << 8;
2379     v |= cirrus_linear_readb(opaque, addr + 1);
2380 #else
2381     v = cirrus_linear_readb(opaque, addr);
2382     v |= cirrus_linear_readb(opaque, addr + 1) << 8;
2383 #endif
2384     return v;
2385 }
2386  
2387 static uint32_t cirrus_linear_readl(void *opaque, target_phys_addr_t addr)
2388 {
2389     uint32_t v;
2390 #ifdef TARGET_WORDS_BIGENDIAN
2391     v = cirrus_linear_readb(opaque, addr) << 24;
2392     v |= cirrus_linear_readb(opaque, addr + 1) << 16;
2393     v |= cirrus_linear_readb(opaque, addr + 2) << 8;
2394     v |= cirrus_linear_readb(opaque, addr + 3);
2395 #else
2396     v = cirrus_linear_readb(opaque, addr);
2397     v |= cirrus_linear_readb(opaque, addr + 1) << 8;
2398     v |= cirrus_linear_readb(opaque, addr + 2) << 16;
2399     v |= cirrus_linear_readb(opaque, addr + 3) << 24;
2400 #endif
2401     return v;
2402 }
2403  
2404 static void cirrus_linear_writeb(void *opaque, target_phys_addr_t addr,
2405                                  uint32_t val)
2406 {
2407     CirrusVGAState *s = opaque;
2408     unsigned mode;
2409  
2410     addr &= s->cirrus_addr_mask;
2411  
2412     if (((s->vga.sr[0x17] & 0x44) == 0x44) &&
2413         ((addr & s->linear_mmio_mask) ==  s->linear_mmio_mask)) {
2414         /* memory-mapped I/O */
2415         cirrus_mmio_blt_write(s, addr & 0xff, val);
2416     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2417         /* bitblt */
2418         *s->cirrus_srcptr++ = (uint8_t) val;
2419         if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2420             cirrus_bitblt_cputovideo_next(s);
2421         }
2422     } else {
2423         /* video memory */
2424         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2425             addr <<= 4;
2426         } else if (s->vga.gr[0x0B] & 0x02) {
2427             addr <<= 3;
2428         }
2429         addr &= s->cirrus_addr_mask;
2430  
2431         mode = s->vga.gr[0x05] & 0x7;
2432         if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2433             *(s->vga.vram_ptr + addr) = (uint8_t) val;
2434             cpu_physical_memory_set_dirty(s->vga.vram_offset + addr);
2435         } else {
2436             if ((s->vga.gr[0x0B] & 0x14) != 0x14) {
2437                 cirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);
2438             } else {
2439                 cirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);
2440             }
2441         }
2442     }
2443 }
2444  
2445 static void cirrus_linear_writew(void *opaque, target_phys_addr_t addr,
2446                                  uint32_t val)
2447 {
2448 #ifdef TARGET_WORDS_BIGENDIAN
2449     cirrus_linear_writeb(opaque, addr, (val >> 8) & 0xff);
2450     cirrus_linear_writeb(opaque, addr + 1, val & 0xff);
2451 #else
2452     cirrus_linear_writeb(opaque, addr, val & 0xff);
2453     cirrus_linear_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2454 #endif
2455 }
2456  
2457 static void cirrus_linear_writel(void *opaque, target_phys_addr_t addr,
2458                                  uint32_t val)
2459 {
2460 #ifdef TARGET_WORDS_BIGENDIAN
2461     cirrus_linear_writeb(opaque, addr, (val >> 24) & 0xff);
2462     cirrus_linear_writeb(opaque, addr + 1, (val >> 16) & 0xff);
2463     cirrus_linear_writeb(opaque, addr + 2, (val >> 8) & 0xff);
2464     cirrus_linear_writeb(opaque, addr + 3, val & 0xff);
2465 #else
2466     cirrus_linear_writeb(opaque, addr, val & 0xff);
2467     cirrus_linear_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2468     cirrus_linear_writeb(opaque, addr + 2, (val >> 16) & 0xff);
2469     cirrus_linear_writeb(opaque, addr + 3, (val >> 24) & 0xff);
2470 #endif
2471 }
2472  
2473  
2474 static CPUReadMemoryFunc * const cirrus_linear_read[3] = {
2475     cirrus_linear_readb,
2476     cirrus_linear_readw,
2477     cirrus_linear_readl,
2478 };
2479  
2480 static CPUWriteMemoryFunc * const cirrus_linear_write[3] = {
2481     cirrus_linear_writeb,
2482     cirrus_linear_writew,
2483     cirrus_linear_writel,
2484 };
2485  
2486 /***************************************
2487  *
2488  *  system to screen memory access
2489  *
2490  ***************************************/
2491  
2492  
2493 static uint32_t cirrus_linear_bitblt_readb(void *opaque, target_phys_addr_t addr)
2494 {
2495     uint32_t ret;
2496  
2497     /* XXX handle bitblt */
2498     ret = 0xff;
2499     return ret;
2500 }
2501  
2502 static uint32_t cirrus_linear_bitblt_readw(void *opaque, target_phys_addr_t addr)
2503 {
2504     uint32_t v;
2505 #ifdef TARGET_WORDS_BIGENDIAN
2506     v = cirrus_linear_bitblt_readb(opaque, addr) << 8;
2507     v |= cirrus_linear_bitblt_readb(opaque, addr + 1);
2508 #else
2509     v = cirrus_linear_bitblt_readb(opaque, addr);
2510     v |= cirrus_linear_bitblt_readb(opaque, addr + 1) << 8;
2511 #endif
2512     return v;
2513 }
2514  
2515 static uint32_t cirrus_linear_bitblt_readl(void *opaque, target_phys_addr_t addr)
2516 {
2517     uint32_t v;
2518 #ifdef TARGET_WORDS_BIGENDIAN
2519     v = cirrus_linear_bitblt_readb(opaque, addr) << 24;
2520     v |= cirrus_linear_bitblt_readb(opaque, addr + 1) << 16;
2521     v |= cirrus_linear_bitblt_readb(opaque, addr + 2) << 8;
2522     v |= cirrus_linear_bitblt_readb(opaque, addr + 3);
2523 #else
2524     v = cirrus_linear_bitblt_readb(opaque, addr);
2525     v |= cirrus_linear_bitblt_readb(opaque, addr + 1) << 8;
2526     v |= cirrus_linear_bitblt_readb(opaque, addr + 2) << 16;
2527     v |= cirrus_linear_bitblt_readb(opaque, addr + 3) << 24;
2528 #endif
2529     return v;
2530 }
2531  
2532 static void cirrus_linear_bitblt_writeb(void *opaque, target_phys_addr_t addr,
2533                                  uint32_t val)
2534 {
2535     CirrusVGAState *s = opaque;
2536  
2537     if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2538         /* bitblt */
2539         *s->cirrus_srcptr++ = (uint8_t) val;
2540         if (s->cirrus_srcptr >= s->cirrus_srcptr_end) {
2541             cirrus_bitblt_cputovideo_next(s);
2542         }
2543     }
2544 }
2545  
2546 static void cirrus_linear_bitblt_writew(void *opaque, target_phys_addr_t addr,
2547                                  uint32_t val)
2548 {
2549 #ifdef TARGET_WORDS_BIGENDIAN
2550     cirrus_linear_bitblt_writeb(opaque, addr, (val >> 8) & 0xff);
2551     cirrus_linear_bitblt_writeb(opaque, addr + 1, val & 0xff);
2552 #else
2553     cirrus_linear_bitblt_writeb(opaque, addr, val & 0xff);
2554     cirrus_linear_bitblt_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2555 #endif
2556 }
2557  
2558 static void cirrus_linear_bitblt_writel(void *opaque, target_phys_addr_t addr,
2559                                  uint32_t val)
2560 {
2561 #ifdef TARGET_WORDS_BIGENDIAN
2562     cirrus_linear_bitblt_writeb(opaque, addr, (val >> 24) & 0xff);
2563     cirrus_linear_bitblt_writeb(opaque, addr + 1, (val >> 16) & 0xff);
2564     cirrus_linear_bitblt_writeb(opaque, addr + 2, (val >> 8) & 0xff);
2565     cirrus_linear_bitblt_writeb(opaque, addr + 3, val & 0xff);
2566 #else
2567     cirrus_linear_bitblt_writeb(opaque, addr, val & 0xff);
2568     cirrus_linear_bitblt_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2569     cirrus_linear_bitblt_writeb(opaque, addr + 2, (val >> 16) & 0xff);
2570     cirrus_linear_bitblt_writeb(opaque, addr + 3, (val >> 24) & 0xff);
2571 #endif
2572 }
2573  
2574  
2575 static CPUReadMemoryFunc * const cirrus_linear_bitblt_read[3] = {
2576     cirrus_linear_bitblt_readb,
2577     cirrus_linear_bitblt_readw,
2578     cirrus_linear_bitblt_readl,
2579 };
2580  
2581 static CPUWriteMemoryFunc * const cirrus_linear_bitblt_write[3] = {
2582     cirrus_linear_bitblt_writeb,
2583     cirrus_linear_bitblt_writew,
2584     cirrus_linear_bitblt_writel,
2585 };
2586  
2587 static void map_linear_vram(CirrusVGAState *s)
2588 {
79 roytam 2589     if (!s->vga.vga_io_memory)
2590         return;
2591  
74 roytam 2592     if (!s->vga.map_addr && s->vga.lfb_addr && s->vga.lfb_end) {
2593         s->vga.map_addr = s->vga.lfb_addr;
2594         s->vga.map_end = s->vga.lfb_end;
2595         cpu_register_physical_memory(s->vga.map_addr, s->vga.map_end - s->vga.map_addr, s->vga.vram_offset);
2596     }
2597  
2598     if (!s->vga.map_addr)
2599         return;
2600  
2601     s->vga.lfb_vram_mapped = 0;
2602  
2603     if (!(s->cirrus_srcptr != s->cirrus_srcptr_end)
2604         && !((s->vga.sr[0x07] & 0x01) == 0)
2605         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
2606         && !(s->vga.gr[0x0B] & 0x02)) {
2607  
2608         cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x8000,
2609                                     (s->vga.vram_offset + s->cirrus_bank_base[0]) | IO_MEM_RAM);
2610         cpu_register_physical_memory(isa_mem_base + 0xa8000, 0x8000,
2611                                     (s->vga.vram_offset + s->cirrus_bank_base[1]) | IO_MEM_RAM);
2612  
2613         s->vga.lfb_vram_mapped = 1;
2614     }
2615     else {
2616         cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
2617                                      s->vga.vga_io_memory);
2618     }
2619  
2620     vga_dirty_log_start(&s->vga);
2621 }
2622  
2623 static void unmap_linear_vram(CirrusVGAState *s)
2624 {
79 roytam 2625     if (!s->vga.vga_io_memory)
2626         return;
2627  
74 roytam 2628     if (s->vga.map_addr && s->vga.lfb_addr && s->vga.lfb_end)
2629         s->vga.map_addr = s->vga.map_end = 0;
2630  
2631     cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
2632                                  s->vga.vga_io_memory);
2633 }
2634  
2635 /* Compute the memory access functions */
2636 static void cirrus_update_memory_access(CirrusVGAState *s)
2637 {
2638     unsigned mode;
2639  
2640     if ((s->vga.sr[0x17] & 0x44) == 0x44) {
2641         goto generic_io;
2642     } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {
2643         goto generic_io;
2644     } else {
2645         if ((s->vga.gr[0x0B] & 0x14) == 0x14) {
2646             goto generic_io;
2647         } else if (s->vga.gr[0x0B] & 0x02) {
2648             goto generic_io;
2649         }
2650  
2651         mode = s->vga.gr[0x05] & 0x7;
2652         if (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {
2653             map_linear_vram(s);
2654         } else {
2655         generic_io:
2656             unmap_linear_vram(s);
2657         }
2658     }
2659 }
2660  
2661  
2662 /* I/O ports */
2663  
2664 static uint32_t cirrus_vga_ioport_read(void *opaque, uint32_t addr)
2665 {
2666     CirrusVGAState *c = opaque;
2667     VGACommonState *s = &c->vga;
2668     int val, index;
2669  
2670     if (vga_ioport_invalid(s, addr)) {
2671         val = 0xff;
2672     } else {
2673         switch (addr) {
2674         case 0x3c0:
2675             if (s->ar_flip_flop == 0) {
2676                 val = s->ar_index;
2677             } else {
2678                 val = 0;
2679             }
2680             break;
2681         case 0x3c1:
2682             index = s->ar_index & 0x1f;
2683             if (index < 21)
2684                 val = s->ar[index];
2685             else
2686                 val = 0;
2687             break;
2688         case 0x3c2:
2689             val = s->st00;
2690             break;
2691         case 0x3c4:
2692             val = s->sr_index;
2693             break;
2694         case 0x3c5:
2695             val = cirrus_vga_read_sr(c);
2696             break;
2697 #ifdef DEBUG_VGA_REG
2698             printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
2699 #endif
2700             break;
2701         case 0x3c6:
2702             val = cirrus_read_hidden_dac(c);
2703             break;
2704         case 0x3c7:
2705             val = s->dac_state;
2706             break;
2707         case 0x3c8:
2708             val = s->dac_write_index;
2709             c->cirrus_hidden_dac_lockindex = 0;
2710             break;
2711         case 0x3c9:
2712             val = cirrus_vga_read_palette(c);
2713             break;
2714         case 0x3ca:
2715             val = s->fcr;
2716             break;
2717         case 0x3cc:
2718             val = s->msr;
2719             break;
2720         case 0x3ce:
2721             val = s->gr_index;
2722             break;
2723         case 0x3cf:
2724             val = cirrus_vga_read_gr(c, s->gr_index);
2725 #ifdef DEBUG_VGA_REG
2726             printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
2727 #endif
2728             break;
2729         case 0x3b4:
2730         case 0x3d4:
2731             val = s->cr_index;
2732             break;
2733         case 0x3b5:
2734         case 0x3d5:
2735             val = cirrus_vga_read_cr(c, s->cr_index);
2736 #ifdef DEBUG_VGA_REG
2737             printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
2738 #endif
2739             break;
2740         case 0x3ba:
2741         case 0x3da:
2742             /* just toggle to fool polling */
2743             val = s->st01 = s->retrace(s);
2744             s->ar_flip_flop = 0;
2745             break;
2746         default:
2747             val = 0x00;
2748             break;
2749         }
2750     }
2751 #if defined(DEBUG_VGA)
2752     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
2753 #endif
2754     return val;
2755 }
2756  
2757 static void cirrus_vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
2758 {
2759     CirrusVGAState *c = opaque;
2760     VGACommonState *s = &c->vga;
2761     int index;
2762  
2763     /* check port range access depending on color/monochrome mode */
2764     if (vga_ioport_invalid(s, addr)) {
2765         return;
2766     }
2767 #ifdef DEBUG_VGA
2768     printf("VGA: write addr=0x%04x data=0x%02x\n", addr, val);
2769 #endif
2770  
2771     switch (addr) {
2772     case 0x3c0:
2773         if (s->ar_flip_flop == 0) {
2774             val &= 0x3f;
2775             s->ar_index = val;
2776         } else {
2777             index = s->ar_index & 0x1f;
2778             switch (index) {
2779             case 0x00 ... 0x0f:
2780                 s->ar[index] = val & 0x3f;
2781                 break;
2782             case 0x10:
2783                 s->ar[index] = val & ~0x10;
2784                 break;
2785             case 0x11:
2786                 s->ar[index] = val;
2787                 break;
2788             case 0x12:
2789                 s->ar[index] = val & ~0xc0;
2790                 break;
2791             case 0x13:
2792                 s->ar[index] = val & ~0xf0;
2793                 break;
2794             case 0x14:
2795                 s->ar[index] = val & ~0xf0;
2796                 break;
2797             default:
2798                 break;
2799             }
2800         }
2801         s->ar_flip_flop ^= 1;
2802         break;
2803     case 0x3c2:
2804         s->msr = val & ~0x10;
2805         s->update_retrace_info(s);
2806         break;
2807     case 0x3c4:
2808         s->sr_index = val;
2809         break;
2810     case 0x3c5:
2811 #ifdef DEBUG_VGA_REG
2812         printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
2813 #endif
2814         cirrus_vga_write_sr(c, val);
2815         break;
2816         break;
2817     case 0x3c6:
2818         cirrus_write_hidden_dac(c, val);
2819         break;
2820     case 0x3c7:
2821         s->dac_read_index = val;
2822         s->dac_sub_index = 0;
2823         s->dac_state = 3;
2824         break;
2825     case 0x3c8:
2826         s->dac_write_index = val;
2827         s->dac_sub_index = 0;
2828         s->dac_state = 0;
2829         break;
2830     case 0x3c9:
2831         cirrus_vga_write_palette(c, val);
2832         break;
2833     case 0x3ce:
2834         s->gr_index = val;
2835         break;
2836     case 0x3cf:
2837 #ifdef DEBUG_VGA_REG
2838         printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
2839 #endif
2840         cirrus_vga_write_gr(c, s->gr_index, val);
2841         break;
2842     case 0x3b4:
2843     case 0x3d4:
2844         s->cr_index = val;
2845         break;
2846     case 0x3b5:
2847     case 0x3d5:
2848 #ifdef DEBUG_VGA_REG
2849         printf("vga: write CR%x = 0x%02x\n", s->cr_index, val);
2850 #endif
2851         cirrus_vga_write_cr(c, val);
2852         break;
2853     case 0x3ba:
2854     case 0x3da:
2855         s->fcr = val & 0x10;
2856         break;
2857     }
2858 }
2859  
2860 /***************************************
2861  *
2862  *  memory-mapped I/O access
2863  *
2864  ***************************************/
2865  
2866 static uint32_t cirrus_mmio_readb(void *opaque, target_phys_addr_t addr)
2867 {
2868     CirrusVGAState *s = opaque;
2869  
2870     addr &= CIRRUS_PNPMMIO_SIZE - 1;
2871  
2872     if (addr >= 0x100) {
2873         return cirrus_mmio_blt_read(s, addr - 0x100);
2874     } else {
2875         return cirrus_vga_ioport_read(s, addr + 0x3c0);
2876     }
2877 }
2878  
2879 static uint32_t cirrus_mmio_readw(void *opaque, target_phys_addr_t addr)
2880 {
2881     uint32_t v;
2882 #ifdef TARGET_WORDS_BIGENDIAN
2883     v = cirrus_mmio_readb(opaque, addr) << 8;
2884     v |= cirrus_mmio_readb(opaque, addr + 1);
2885 #else
2886     v = cirrus_mmio_readb(opaque, addr);
2887     v |= cirrus_mmio_readb(opaque, addr + 1) << 8;
2888 #endif
2889     return v;
2890 }
2891  
2892 static uint32_t cirrus_mmio_readl(void *opaque, target_phys_addr_t addr)
2893 {
2894     uint32_t v;
2895 #ifdef TARGET_WORDS_BIGENDIAN
2896     v = cirrus_mmio_readb(opaque, addr) << 24;
2897     v |= cirrus_mmio_readb(opaque, addr + 1) << 16;
2898     v |= cirrus_mmio_readb(opaque, addr + 2) << 8;
2899     v |= cirrus_mmio_readb(opaque, addr + 3);
2900 #else
2901     v = cirrus_mmio_readb(opaque, addr);
2902     v |= cirrus_mmio_readb(opaque, addr + 1) << 8;
2903     v |= cirrus_mmio_readb(opaque, addr + 2) << 16;
2904     v |= cirrus_mmio_readb(opaque, addr + 3) << 24;
2905 #endif
2906     return v;
2907 }
2908  
2909 static void cirrus_mmio_writeb(void *opaque, target_phys_addr_t addr,
2910                                uint32_t val)
2911 {
2912     CirrusVGAState *s = opaque;
2913  
2914     addr &= CIRRUS_PNPMMIO_SIZE - 1;
2915  
2916     if (addr >= 0x100) {
2917         cirrus_mmio_blt_write(s, addr - 0x100, val);
2918     } else {
2919         cirrus_vga_ioport_write(s, addr + 0x3c0, val);
2920     }
2921 }
2922  
2923 static void cirrus_mmio_writew(void *opaque, target_phys_addr_t addr,
2924                                uint32_t val)
2925 {
2926 #ifdef TARGET_WORDS_BIGENDIAN
2927     cirrus_mmio_writeb(opaque, addr, (val >> 8) & 0xff);
2928     cirrus_mmio_writeb(opaque, addr + 1, val & 0xff);
2929 #else
2930     cirrus_mmio_writeb(opaque, addr, val & 0xff);
2931     cirrus_mmio_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2932 #endif
2933 }
2934  
2935 static void cirrus_mmio_writel(void *opaque, target_phys_addr_t addr,
2936                                uint32_t val)
2937 {
2938 #ifdef TARGET_WORDS_BIGENDIAN
2939     cirrus_mmio_writeb(opaque, addr, (val >> 24) & 0xff);
2940     cirrus_mmio_writeb(opaque, addr + 1, (val >> 16) & 0xff);
2941     cirrus_mmio_writeb(opaque, addr + 2, (val >> 8) & 0xff);
2942     cirrus_mmio_writeb(opaque, addr + 3, val & 0xff);
2943 #else
2944     cirrus_mmio_writeb(opaque, addr, val & 0xff);
2945     cirrus_mmio_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2946     cirrus_mmio_writeb(opaque, addr + 2, (val >> 16) & 0xff);
2947     cirrus_mmio_writeb(opaque, addr + 3, (val >> 24) & 0xff);
2948 #endif
2949 }
2950  
2951  
2952 static CPUReadMemoryFunc * const cirrus_mmio_read[3] = {
2953     cirrus_mmio_readb,
2954     cirrus_mmio_readw,
2955     cirrus_mmio_readl,
2956 };
2957  
2958 static CPUWriteMemoryFunc * const cirrus_mmio_write[3] = {
2959     cirrus_mmio_writeb,
2960     cirrus_mmio_writew,
2961     cirrus_mmio_writel,
2962 };
2963  
2964 /* load/save state */
2965  
2966 static int cirrus_post_load(void *opaque, int version_id)
2967 {
2968     CirrusVGAState *s = opaque;
2969  
2970     s->vga.gr[0x00] = s->cirrus_shadow_gr0 & 0x0f;
2971     s->vga.gr[0x01] = s->cirrus_shadow_gr1 & 0x0f;
2972  
2973     cirrus_update_memory_access(s);
2974     /* force refresh */
2975     s->vga.graphic_mode = -1;
2976     cirrus_update_bank_ptr(s, 0);
2977     cirrus_update_bank_ptr(s, 1);
2978     return 0;
2979 }
2980  
2981 static const VMStateDescription vmstate_cirrus_vga = {
2982     .name = "cirrus_vga",
2983     .version_id = 2,
2984     .minimum_version_id = 1,
2985     .minimum_version_id_old = 1,
2986     .post_load = cirrus_post_load,
2987     .fields      = (VMStateField []) {
2988         VMSTATE_UINT32(vga.latch, CirrusVGAState),
2989         VMSTATE_UINT8(vga.sr_index, CirrusVGAState),
2990         VMSTATE_BUFFER(vga.sr, CirrusVGAState),
2991         VMSTATE_UINT8(vga.gr_index, CirrusVGAState),
2992         VMSTATE_UINT8(cirrus_shadow_gr0, CirrusVGAState),
2993         VMSTATE_UINT8(cirrus_shadow_gr1, CirrusVGAState),
2994         VMSTATE_BUFFER_START_MIDDLE(vga.gr, CirrusVGAState, 2),
2995         VMSTATE_UINT8(vga.ar_index, CirrusVGAState),
2996         VMSTATE_BUFFER(vga.ar, CirrusVGAState),
2997         VMSTATE_INT32(vga.ar_flip_flop, CirrusVGAState),
2998         VMSTATE_UINT8(vga.cr_index, CirrusVGAState),
2999         VMSTATE_BUFFER(vga.cr, CirrusVGAState),
3000         VMSTATE_UINT8(vga.msr, CirrusVGAState),
3001         VMSTATE_UINT8(vga.fcr, CirrusVGAState),
3002         VMSTATE_UINT8(vga.st00, CirrusVGAState),
3003         VMSTATE_UINT8(vga.st01, CirrusVGAState),
3004         VMSTATE_UINT8(vga.dac_state, CirrusVGAState),
3005         VMSTATE_UINT8(vga.dac_sub_index, CirrusVGAState),
3006         VMSTATE_UINT8(vga.dac_read_index, CirrusVGAState),
3007         VMSTATE_UINT8(vga.dac_write_index, CirrusVGAState),
3008         VMSTATE_BUFFER(vga.dac_cache, CirrusVGAState),
3009         VMSTATE_BUFFER(vga.palette, CirrusVGAState),
3010         VMSTATE_INT32(vga.bank_offset, CirrusVGAState),
3011         VMSTATE_UINT8(cirrus_hidden_dac_lockindex, CirrusVGAState),
3012         VMSTATE_UINT8(cirrus_hidden_dac_data, CirrusVGAState),
3013         VMSTATE_UINT32(hw_cursor_x, CirrusVGAState),
3014         VMSTATE_UINT32(hw_cursor_y, CirrusVGAState),
3015         /* XXX: we do not save the bitblt state - we assume we do not save
3016            the state when the blitter is active */
3017         VMSTATE_END_OF_LIST()
3018     }
3019 };
3020  
3021 static const VMStateDescription vmstate_pci_cirrus_vga = {
3022     .name = "cirrus_vga",
3023     .version_id = 2,
3024     .minimum_version_id = 2,
3025     .minimum_version_id_old = 2,
3026     .post_load = cirrus_post_load,
3027     .fields      = (VMStateField []) {
3028         VMSTATE_PCI_DEVICE(dev, PCICirrusVGAState),
3029         VMSTATE_STRUCT(cirrus_vga, PCICirrusVGAState, 0,
3030                        vmstate_cirrus_vga, CirrusVGAState),
3031         VMSTATE_END_OF_LIST()
3032     }
3033 };
3034  
3035 /***************************************
3036  *
3037  *  initialize
3038  *
3039  ***************************************/
3040  
3041 static void cirrus_reset(void *opaque)
3042 {
3043     CirrusVGAState *s = opaque;
3044  
3045     vga_common_reset(&s->vga);
3046     unmap_linear_vram(s);
3047     s->vga.sr[0x06] = 0x0f;
3048     if (s->device_id == CIRRUS_ID_CLGD5446) {
3049         /* 4MB 64 bit memory config, always PCI */
3050         s->vga.sr[0x1F] = 0x2d;         // MemClock
3051         s->vga.gr[0x18] = 0x0f;             // fastest memory configuration
3052         s->vga.sr[0x0f] = 0x98;
3053         s->vga.sr[0x17] = 0x20;
3054         s->vga.sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
3055     } else {
3056         s->vga.sr[0x1F] = 0x22;         // MemClock
3057         s->vga.sr[0x0F] = CIRRUS_MEMSIZE_2M;
3058         s->vga.sr[0x17] = s->bustype;
3059         s->vga.sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
3060     }
3061     s->vga.cr[0x27] = s->device_id;
3062  
3063     /* Win2K seems to assume that the pattern buffer is at 0xff
3064        initially ! */
3065     memset(s->vga.vram_ptr, 0xff, s->real_vram_size);
3066  
3067     s->cirrus_hidden_dac_lockindex = 5;
3068     s->cirrus_hidden_dac_data = 0;
3069 }
3070  
79 roytam 3071 static void cirrus_init_device(CirrusVGAState * s,
3072                                int device_id, int vram_size, int is_pci)
74 roytam 3073 {
3074     int i;
3075     static int inited;
3076  
3077     if (!inited) {
3078         inited = 1;
3079         for(i = 0;i < 256; i++)
3080             rop_to_index[i] = CIRRUS_ROP_NOP_INDEX; /* nop rop */
3081         rop_to_index[CIRRUS_ROP_0] = 0;
3082         rop_to_index[CIRRUS_ROP_SRC_AND_DST] = 1;
3083         rop_to_index[CIRRUS_ROP_NOP] = 2;
3084         rop_to_index[CIRRUS_ROP_SRC_AND_NOTDST] = 3;
3085         rop_to_index[CIRRUS_ROP_NOTDST] = 4;
3086         rop_to_index[CIRRUS_ROP_SRC] = 5;
3087         rop_to_index[CIRRUS_ROP_1] = 6;
3088         rop_to_index[CIRRUS_ROP_NOTSRC_AND_DST] = 7;
3089         rop_to_index[CIRRUS_ROP_SRC_XOR_DST] = 8;
3090         rop_to_index[CIRRUS_ROP_SRC_OR_DST] = 9;
3091         rop_to_index[CIRRUS_ROP_NOTSRC_OR_NOTDST] = 10;
3092         rop_to_index[CIRRUS_ROP_SRC_NOTXOR_DST] = 11;
3093         rop_to_index[CIRRUS_ROP_SRC_OR_NOTDST] = 12;
3094         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
3095         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
3096         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
3097         s->device_id = device_id;
3098         if (is_pci)
3099             s->bustype = CIRRUS_BUSTYPE_PCI;
3100         else
3101             s->bustype = CIRRUS_BUSTYPE_ISA;
3102     }
3103  
79 roytam 3104     s->real_vram_size = vram_size;
3105  
3106     /* XXX: s->vga.vram_size must be a power of two */
3107     s->cirrus_addr_mask = s->real_vram_size - 1;
3108     s->linear_mmio_mask = s->real_vram_size - 256;
3109  
3110     s->vga.get_bpp = cirrus_get_bpp;
3111     s->vga.get_offsets = cirrus_get_offsets;
3112     s->vga.get_resolution = cirrus_get_resolution;
3113     s->vga.cursor_invalidate = cirrus_cursor_invalidate;
3114     s->vga.cursor_draw_line = cirrus_cursor_draw_line;
3115 }
3116  
3117 static void cirrus_init_ioport(CirrusVGAState * s)
3118 {
74 roytam 3119     register_ioport_write(0x3c0, 16, 1, cirrus_vga_ioport_write, s);
3120  
3121     register_ioport_write(0x3b4, 2, 1, cirrus_vga_ioport_write, s);
3122     register_ioport_write(0x3d4, 2, 1, cirrus_vga_ioport_write, s);
3123     register_ioport_write(0x3ba, 1, 1, cirrus_vga_ioport_write, s);
3124     register_ioport_write(0x3da, 1, 1, cirrus_vga_ioport_write, s);
3125  
3126     register_ioport_read(0x3c0, 16, 1, cirrus_vga_ioport_read, s);
3127  
3128     register_ioport_read(0x3b4, 2, 1, cirrus_vga_ioport_read, s);
3129     register_ioport_read(0x3d4, 2, 1, cirrus_vga_ioport_read, s);
3130     register_ioport_read(0x3ba, 1, 1, cirrus_vga_ioport_read, s);
3131     register_ioport_read(0x3da, 1, 1, cirrus_vga_ioport_read, s);
3132  
3133     s->vga.vga_io_memory = cpu_register_io_memory(cirrus_vga_mem_read,
3134                                                   cirrus_vga_mem_write, s);
3135     cpu_register_physical_memory(isa_mem_base + 0x000a0000, 0x20000,
3136                                  s->vga.vga_io_memory);
3137     qemu_register_coalesced_mmio(isa_mem_base + 0x000a0000, 0x20000);
3138  
3139     /* I/O handler for LFB */
3140     s->cirrus_linear_io_addr =
3141         cpu_register_io_memory(cirrus_linear_read, cirrus_linear_write, s);
3142  
3143     /* I/O handler for LFB */
3144     s->cirrus_linear_bitblt_io_addr =
3145         cpu_register_io_memory(cirrus_linear_bitblt_read,
3146                                cirrus_linear_bitblt_write, s);
3147  
3148     /* I/O handler for memory-mapped I/O */
3149     s->cirrus_mmio_io_addr =
3150         cpu_register_io_memory(cirrus_mmio_read, cirrus_mmio_write, s);
79 roytam 3151 }
74 roytam 3152  
79 roytam 3153 static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
3154 {
3155     int vram_size =
74 roytam 3156         (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
3157  
79 roytam 3158     cirrus_init_device(s, device_id, vram_size, is_pci);
3159     cirrus_init_ioport(s);
74 roytam 3160     qemu_register_reset(cirrus_reset, s);
3161     cirrus_reset(s);
3162 }
3163  
3164 /***************************************
3165  *
3166  *  ISA bus support