qemu/hw/display/ati.c
<<
>>
Prefs
   1/*
   2 * QEMU ATI SVGA emulation
   3 *
   4 * Copyright (c) 2019 BALATON Zoltan
   5 *
   6 * This work is licensed under the GNU GPL license version 2 or later.
   7 */
   8
   9/*
  10 * WARNING:
  11 * This is very incomplete and only enough for Linux console and some
  12 * unaccelerated X output at the moment.
  13 * Currently it's little more than a frame buffer with minimal functions,
  14 * other more advanced features of the hardware are yet to be implemented.
  15 * We only aim for Rage 128 Pro (and some RV100) and 2D only at first,
  16 * No 3D at all yet (maybe after 2D works, but feel free to improve it)
  17 */
  18
  19#include "qemu/osdep.h"
  20#include "ati_int.h"
  21#include "ati_regs.h"
  22#include "vga-access.h"
  23#include "hw/qdev-properties.h"
  24#include "vga_regs.h"
  25#include "qemu/log.h"
  26#include "qemu/module.h"
  27#include "qemu/error-report.h"
  28#include "qapi/error.h"
  29#include "ui/console.h"
  30#include "hw/display/i2c-ddc.h"
  31#include "trace.h"
  32
  33#define ATI_DEBUG_HW_CURSOR 0
  34
  35static const struct {
  36    const char *name;
  37    uint16_t dev_id;
  38} ati_model_aliases[] = {
  39    { "rage128p", PCI_DEVICE_ID_ATI_RAGE128_PF },
  40    { "rv100", PCI_DEVICE_ID_ATI_RADEON_QY },
  41};
  42
  43enum { VGA_MODE, EXT_MODE };
  44
  45static void ati_vga_switch_mode(ATIVGAState *s)
  46{
  47    DPRINTF("%d -> %d\n",
  48            s->mode, !!(s->regs.crtc_gen_cntl & CRTC2_EXT_DISP_EN));
  49    if (s->regs.crtc_gen_cntl & CRTC2_EXT_DISP_EN) {
  50        /* Extended mode enabled */
  51        s->mode = EXT_MODE;
  52        if (s->regs.crtc_gen_cntl & CRTC2_EN) {
  53            /* CRT controller enabled, use CRTC values */
  54            /* FIXME Should these be the same as VGA CRTC regs? */
  55            uint32_t offs = s->regs.crtc_offset & 0x07ffffff;
  56            int stride = (s->regs.crtc_pitch & 0x7ff) * 8;
  57            int bpp = 0;
  58            int h, v;
  59
  60            if (s->regs.crtc_h_total_disp == 0) {
  61                s->regs.crtc_h_total_disp = ((640 / 8) - 1) << 16;
  62            }
  63            if (s->regs.crtc_v_total_disp == 0) {
  64                s->regs.crtc_v_total_disp = (480 - 1) << 16;
  65            }
  66            h = ((s->regs.crtc_h_total_disp >> 16) + 1) * 8;
  67            v = (s->regs.crtc_v_total_disp >> 16) + 1;
  68            switch (s->regs.crtc_gen_cntl & CRTC_PIX_WIDTH_MASK) {
  69            case CRTC_PIX_WIDTH_4BPP:
  70                bpp = 4;
  71                break;
  72            case CRTC_PIX_WIDTH_8BPP:
  73                bpp = 8;
  74                break;
  75            case CRTC_PIX_WIDTH_15BPP:
  76                bpp = 15;
  77                break;
  78            case CRTC_PIX_WIDTH_16BPP:
  79                bpp = 16;
  80                break;
  81            case CRTC_PIX_WIDTH_24BPP:
  82                bpp = 24;
  83                break;
  84            case CRTC_PIX_WIDTH_32BPP:
  85                bpp = 32;
  86                break;
  87            default:
  88                qemu_log_mask(LOG_UNIMP, "Unsupported bpp value\n");
  89                return;
  90            }
  91            DPRINTF("Switching to %dx%d %d %d @ %x\n", h, v, stride, bpp, offs);
  92            vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_ENABLE);
  93            vbe_ioport_write_data(&s->vga, 0, VBE_DISPI_DISABLED);
  94            s->vga.big_endian_fb = (s->regs.config_cntl & APER_0_ENDIAN ||
  95                                    s->regs.config_cntl & APER_1_ENDIAN ?
  96                                    true : false);
  97            /* reset VBE regs then set up mode */
  98            s->vga.vbe_regs[VBE_DISPI_INDEX_XRES] = h;
  99            s->vga.vbe_regs[VBE_DISPI_INDEX_YRES] = v;
 100            s->vga.vbe_regs[VBE_DISPI_INDEX_BPP] = bpp;
 101            /* enable mode via ioport so it updates vga regs */
 102            vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_ENABLE);
 103            vbe_ioport_write_data(&s->vga, 0, VBE_DISPI_ENABLED |
 104                VBE_DISPI_LFB_ENABLED | VBE_DISPI_NOCLEARMEM |
 105                (s->regs.dac_cntl & DAC_8BIT_EN ? VBE_DISPI_8BIT_DAC : 0));
 106            /* now set offset and stride after enable as that resets these */
 107            if (stride) {
 108                int bypp = DIV_ROUND_UP(bpp, BITS_PER_BYTE);
 109
 110                vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_VIRT_WIDTH);
 111                vbe_ioport_write_data(&s->vga, 0, stride);
 112                stride *= bypp;
 113                if (offs % stride) {
 114                    DPRINTF("CRTC offset is not multiple of pitch\n");
 115                    vbe_ioport_write_index(&s->vga, 0,
 116                                           VBE_DISPI_INDEX_X_OFFSET);
 117                    vbe_ioport_write_data(&s->vga, 0, offs % stride / bypp);
 118                }
 119                vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_Y_OFFSET);
 120                vbe_ioport_write_data(&s->vga, 0, offs / stride);
 121                DPRINTF("VBE offset (%d,%d), vbe_start_addr=%x\n",
 122                        s->vga.vbe_regs[VBE_DISPI_INDEX_X_OFFSET],
 123                        s->vga.vbe_regs[VBE_DISPI_INDEX_Y_OFFSET],
 124                        s->vga.vbe_start_addr);
 125            }
 126        }
 127    } else {
 128        /* VGA mode enabled */
 129        s->mode = VGA_MODE;
 130        vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_ENABLE);
 131        vbe_ioport_write_data(&s->vga, 0, VBE_DISPI_DISABLED);
 132    }
 133}
 134
 135/* Used by host side hardware cursor */
 136static void ati_cursor_define(ATIVGAState *s)
 137{
 138    uint8_t data[1024];
 139    uint32_t srcoff;
 140    int i, j, idx = 0;
 141
 142    if ((s->regs.cur_offset & BIT(31)) || s->cursor_guest_mode) {
 143        return; /* Do not update cursor if locked or rendered by guest */
 144    }
 145    /* FIXME handle cur_hv_offs correctly */
 146    srcoff = s->regs.cur_offset -
 147        (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16;
 148    for (i = 0; i < 64; i++) {
 149        for (j = 0; j < 8; j++, idx++) {
 150            data[idx] = vga_read_byte(&s->vga, srcoff + i * 16 + j);
 151            data[512 + idx] = vga_read_byte(&s->vga, srcoff + i * 16 + j + 8);
 152        }
 153    }
 154    if (!s->cursor) {
 155        s->cursor = cursor_alloc(64, 64);
 156    }
 157    cursor_set_mono(s->cursor, s->regs.cur_color1, s->regs.cur_color0,
 158                    &data[512], 1, &data[0]);
 159    dpy_cursor_define(s->vga.con, s->cursor);
 160}
 161
 162/* Alternatively support guest rendered hardware cursor */
 163static void ati_cursor_invalidate(VGACommonState *vga)
 164{
 165    ATIVGAState *s = container_of(vga, ATIVGAState, vga);
 166    int size = (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) ? 64 : 0;
 167
 168    if (s->regs.cur_offset & BIT(31)) {
 169        return; /* Do not update cursor if locked */
 170    }
 171    if (s->cursor_size != size ||
 172        vga->hw_cursor_x != s->regs.cur_hv_pos >> 16 ||
 173        vga->hw_cursor_y != (s->regs.cur_hv_pos & 0xffff) ||
 174        s->cursor_offset != s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
 175        (s->regs.cur_hv_offs & 0xffff) * 16) {
 176        /* Remove old cursor then update and show new one if needed */
 177        vga_invalidate_scanlines(vga, vga->hw_cursor_y, vga->hw_cursor_y + 63);
 178        vga->hw_cursor_x = s->regs.cur_hv_pos >> 16;
 179        vga->hw_cursor_y = s->regs.cur_hv_pos & 0xffff;
 180        s->cursor_offset = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
 181                           (s->regs.cur_hv_offs & 0xffff) * 16;
 182        s->cursor_size = size;
 183        if (size) {
 184            vga_invalidate_scanlines(vga,
 185                                     vga->hw_cursor_y, vga->hw_cursor_y + 63);
 186        }
 187    }
 188}
 189
 190static void ati_cursor_draw_line(VGACommonState *vga, uint8_t *d, int scr_y)
 191{
 192    ATIVGAState *s = container_of(vga, ATIVGAState, vga);
 193    uint32_t srcoff;
 194    uint32_t *dp = (uint32_t *)d;
 195    int i, j, h;
 196
 197    if (!(s->regs.crtc_gen_cntl & CRTC2_CUR_EN) ||
 198        scr_y < vga->hw_cursor_y || scr_y >= vga->hw_cursor_y + 64 ||
 199        scr_y > s->regs.crtc_v_total_disp >> 16) {
 200        return;
 201    }
 202    /* FIXME handle cur_hv_offs correctly */
 203    srcoff = s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16;
 204    dp = &dp[vga->hw_cursor_x];
 205    h = ((s->regs.crtc_h_total_disp >> 16) + 1) * 8;
 206    for (i = 0; i < 8; i++) {
 207        uint32_t color;
 208        uint8_t abits = vga_read_byte(vga, srcoff + i);
 209        uint8_t xbits = vga_read_byte(vga, srcoff + i + 8);
 210        for (j = 0; j < 8; j++, abits <<= 1, xbits <<= 1) {
 211            if (abits & BIT(7)) {
 212                if (xbits & BIT(7)) {
 213                    color = dp[i * 8 + j] ^ 0xffffffff; /* complement */
 214                } else {
 215                    continue; /* transparent, no change */
 216                }
 217            } else {
 218                color = (xbits & BIT(7) ? s->regs.cur_color1 :
 219                                          s->regs.cur_color0) | 0xff000000;
 220            }
 221            if (vga->hw_cursor_x + i * 8 + j >= h) {
 222                return; /* end of screen, don't span to next line */
 223            }
 224            dp[i * 8 + j] = color;
 225        }
 226    }
 227}
 228
 229static uint64_t ati_i2c(bitbang_i2c_interface *i2c, uint64_t data, int base)
 230{
 231    bool c = (data & BIT(base + 17) ? !!(data & BIT(base + 1)) : 1);
 232    bool d = (data & BIT(base + 16) ? !!(data & BIT(base)) : 1);
 233
 234    bitbang_i2c_set(i2c, BITBANG_I2C_SCL, c);
 235    d = bitbang_i2c_set(i2c, BITBANG_I2C_SDA, d);
 236
 237    data &= ~0xf00ULL;
 238    if (c) {
 239        data |= BIT(base + 9);
 240    }
 241    if (d) {
 242        data |= BIT(base + 8);
 243    }
 244    return data;
 245}
 246
 247static void ati_vga_update_irq(ATIVGAState *s)
 248{
 249    pci_set_irq(&s->dev, !!(s->regs.gen_int_status & s->regs.gen_int_cntl));
 250}
 251
 252static void ati_vga_vblank_irq(void *opaque)
 253{
 254    ATIVGAState *s = opaque;
 255
 256    timer_mod(&s->vblank_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 257              NANOSECONDS_PER_SECOND / 60);
 258    s->regs.gen_int_status |= CRTC_VBLANK_INT;
 259    ati_vga_update_irq(s);
 260}
 261
 262static inline uint64_t ati_reg_read_offs(uint32_t reg, int offs,
 263                                         unsigned int size)
 264{
 265    if (offs == 0 && size == 4) {
 266        return reg;
 267    } else {
 268        return extract32(reg, offs * BITS_PER_BYTE, size * BITS_PER_BYTE);
 269    }
 270}
 271
 272static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
 273{
 274    ATIVGAState *s = opaque;
 275    uint64_t val = 0;
 276
 277    switch (addr) {
 278    case MM_INDEX:
 279        val = s->regs.mm_index;
 280        break;
 281    case MM_DATA ... MM_DATA + 3:
 282        /* indexed access to regs or memory */
 283        if (s->regs.mm_index & BIT(31)) {
 284            uint32_t idx = s->regs.mm_index & ~BIT(31);
 285            if (idx <= s->vga.vram_size - size) {
 286                val = ldn_le_p(s->vga.vram_ptr + idx, size);
 287            }
 288        } else if (s->regs.mm_index > MM_DATA + 3) {
 289            val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);
 290        } else {
 291            qemu_log_mask(LOG_GUEST_ERROR,
 292                "ati_mm_read: mm_index too small: %u\n", s->regs.mm_index);
 293        }
 294        break;
 295    case BIOS_0_SCRATCH ... BUS_CNTL - 1:
 296    {
 297        int i = (addr - BIOS_0_SCRATCH) / 4;
 298        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF && i > 3) {
 299            break;
 300        }
 301        val = ati_reg_read_offs(s->regs.bios_scratch[i],
 302                                addr - (BIOS_0_SCRATCH + i * 4), size);
 303        break;
 304    }
 305    case GEN_INT_CNTL:
 306        val = s->regs.gen_int_cntl;
 307        break;
 308    case GEN_INT_STATUS:
 309        val = s->regs.gen_int_status;
 310        break;
 311    case CRTC_GEN_CNTL ... CRTC_GEN_CNTL + 3:
 312        val = ati_reg_read_offs(s->regs.crtc_gen_cntl,
 313                                addr - CRTC_GEN_CNTL, size);
 314        break;
 315    case CRTC_EXT_CNTL ... CRTC_EXT_CNTL + 3:
 316        val = ati_reg_read_offs(s->regs.crtc_ext_cntl,
 317                                addr - CRTC_EXT_CNTL, size);
 318        break;
 319    case DAC_CNTL:
 320        val = s->regs.dac_cntl;
 321        break;
 322    case GPIO_VGA_DDC:
 323        val = s->regs.gpio_vga_ddc;
 324        break;
 325    case GPIO_DVI_DDC:
 326        val = s->regs.gpio_dvi_ddc;
 327        break;
 328    case GPIO_MONID ... GPIO_MONID + 3:
 329        val = ati_reg_read_offs(s->regs.gpio_monid,
 330                                addr - GPIO_MONID, size);
 331        break;
 332    case PALETTE_INDEX:
 333        /* FIXME unaligned access */
 334        val = vga_ioport_read(&s->vga, VGA_PEL_IR) << 16;
 335        val |= vga_ioport_read(&s->vga, VGA_PEL_IW) & 0xff;
 336        break;
 337    case PALETTE_DATA:
 338        val = vga_ioport_read(&s->vga, VGA_PEL_D);
 339        break;
 340    case CNFG_CNTL:
 341        val = s->regs.config_cntl;
 342        break;
 343    case CNFG_MEMSIZE:
 344        val = s->vga.vram_size;
 345        break;
 346    case CONFIG_APER_0_BASE:
 347    case CONFIG_APER_1_BASE:
 348        val = pci_default_read_config(&s->dev,
 349                                      PCI_BASE_ADDRESS_0, size) & 0xfffffff0;
 350        break;
 351    case CONFIG_APER_SIZE:
 352        val = s->vga.vram_size;
 353        break;
 354    case CONFIG_REG_1_BASE:
 355        val = pci_default_read_config(&s->dev,
 356                                      PCI_BASE_ADDRESS_2, size) & 0xfffffff0;
 357        break;
 358    case CONFIG_REG_APER_SIZE:
 359        val = memory_region_size(&s->mm);
 360        break;
 361    case MC_STATUS:
 362        val = 5;
 363        break;
 364    case MEM_SDRAM_MODE_REG:
 365        if (s->dev_id != PCI_DEVICE_ID_ATI_RAGE128_PF) {
 366            val = BIT(28) | BIT(20);
 367        }
 368        break;
 369    case RBBM_STATUS:
 370    case GUI_STAT:
 371        val = 64; /* free CMDFIFO entries */
 372        break;
 373    case CRTC_H_TOTAL_DISP:
 374        val = s->regs.crtc_h_total_disp;
 375        break;
 376    case CRTC_H_SYNC_STRT_WID:
 377        val = s->regs.crtc_h_sync_strt_wid;
 378        break;
 379    case CRTC_V_TOTAL_DISP:
 380        val = s->regs.crtc_v_total_disp;
 381        break;
 382    case CRTC_V_SYNC_STRT_WID:
 383        val = s->regs.crtc_v_sync_strt_wid;
 384        break;
 385    case CRTC_OFFSET:
 386        val = s->regs.crtc_offset;
 387        break;
 388    case CRTC_OFFSET_CNTL:
 389        val = s->regs.crtc_offset_cntl;
 390        break;
 391    case CRTC_PITCH:
 392        val = s->regs.crtc_pitch;
 393        break;
 394    case 0xf00 ... 0xfff:
 395        val = pci_default_read_config(&s->dev, addr - 0xf00, size);
 396        break;
 397    case CUR_OFFSET ... CUR_OFFSET + 3:
 398        val = ati_reg_read_offs(s->regs.cur_offset, addr - CUR_OFFSET, size);
 399        break;
 400    case CUR_HORZ_VERT_POSN ... CUR_HORZ_VERT_POSN + 3:
 401        val = ati_reg_read_offs(s->regs.cur_hv_pos,
 402                                addr - CUR_HORZ_VERT_POSN, size);
 403        if (addr + size > CUR_HORZ_VERT_POSN + 3) {
 404            val |= (s->regs.cur_offset & BIT(31)) >> (4 - size);
 405        }
 406        break;
 407    case CUR_HORZ_VERT_OFF ... CUR_HORZ_VERT_OFF + 3:
 408        val = ati_reg_read_offs(s->regs.cur_hv_offs,
 409                                addr - CUR_HORZ_VERT_OFF, size);
 410        if (addr + size > CUR_HORZ_VERT_OFF + 3) {
 411            val |= (s->regs.cur_offset & BIT(31)) >> (4 - size);
 412        }
 413        break;
 414    case CUR_CLR0 ... CUR_CLR0 + 3:
 415        val = ati_reg_read_offs(s->regs.cur_color0, addr - CUR_CLR0, size);
 416        break;
 417    case CUR_CLR1 ... CUR_CLR1 + 3:
 418        val = ati_reg_read_offs(s->regs.cur_color1, addr - CUR_CLR1, size);
 419        break;
 420    case DST_OFFSET:
 421        val = s->regs.dst_offset;
 422        break;
 423    case DST_PITCH:
 424        val = s->regs.dst_pitch;
 425        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 426            val &= s->regs.dst_tile << 16;
 427        }
 428        break;
 429    case DST_WIDTH:
 430        val = s->regs.dst_width;
 431        break;
 432    case DST_HEIGHT:
 433        val = s->regs.dst_height;
 434        break;
 435    case SRC_X:
 436        val = s->regs.src_x;
 437        break;
 438    case SRC_Y:
 439        val = s->regs.src_y;
 440        break;
 441    case DST_X:
 442        val = s->regs.dst_x;
 443        break;
 444    case DST_Y:
 445        val = s->regs.dst_y;
 446        break;
 447    case DP_GUI_MASTER_CNTL:
 448        val = s->regs.dp_gui_master_cntl;
 449        break;
 450    case SRC_OFFSET:
 451        val = s->regs.src_offset;
 452        break;
 453    case SRC_PITCH:
 454        val = s->regs.src_pitch;
 455        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 456            val &= s->regs.src_tile << 16;
 457        }
 458        break;
 459    case DP_BRUSH_BKGD_CLR:
 460        val = s->regs.dp_brush_bkgd_clr;
 461        break;
 462    case DP_BRUSH_FRGD_CLR:
 463        val = s->regs.dp_brush_frgd_clr;
 464        break;
 465    case DP_SRC_FRGD_CLR:
 466        val = s->regs.dp_src_frgd_clr;
 467        break;
 468    case DP_SRC_BKGD_CLR:
 469        val = s->regs.dp_src_bkgd_clr;
 470        break;
 471    case DP_CNTL:
 472        val = s->regs.dp_cntl;
 473        break;
 474    case DP_DATATYPE:
 475        val = s->regs.dp_datatype;
 476        break;
 477    case DP_MIX:
 478        val = s->regs.dp_mix;
 479        break;
 480    case DP_WRITE_MASK:
 481        val = s->regs.dp_write_mask;
 482        break;
 483    case DEFAULT_OFFSET:
 484        val = s->regs.default_offset;
 485        if (s->dev_id != PCI_DEVICE_ID_ATI_RAGE128_PF) {
 486            val >>= 10;
 487            val |= s->regs.default_pitch << 16;
 488            val |= s->regs.default_tile << 30;
 489        }
 490        break;
 491    case DEFAULT_PITCH:
 492        val = s->regs.default_pitch;
 493        val |= s->regs.default_tile << 16;
 494        break;
 495    case DEFAULT_SC_BOTTOM_RIGHT:
 496        val = s->regs.default_sc_bottom_right;
 497        break;
 498    default:
 499        break;
 500    }
 501    if (addr < CUR_OFFSET || addr > CUR_CLR1 || ATI_DEBUG_HW_CURSOR) {
 502        trace_ati_mm_read(size, addr, ati_reg_name(addr & ~3ULL), val);
 503    }
 504    return val;
 505}
 506
 507static inline void ati_reg_write_offs(uint32_t *reg, int offs,
 508                                      uint64_t data, unsigned int size)
 509{
 510    if (offs == 0 && size == 4) {
 511        *reg = data;
 512    } else {
 513        *reg = deposit32(*reg, offs * BITS_PER_BYTE, size * BITS_PER_BYTE,
 514                         data);
 515    }
 516}
 517
 518static void ati_mm_write(void *opaque, hwaddr addr,
 519                           uint64_t data, unsigned int size)
 520{
 521    ATIVGAState *s = opaque;
 522
 523    if (addr < CUR_OFFSET || addr > CUR_CLR1 || ATI_DEBUG_HW_CURSOR) {
 524        trace_ati_mm_write(size, addr, ati_reg_name(addr & ~3ULL), data);
 525    }
 526    switch (addr) {
 527    case MM_INDEX:
 528        s->regs.mm_index = data & ~3;
 529        break;
 530    case MM_DATA ... MM_DATA + 3:
 531        /* indexed access to regs or memory */
 532        if (s->regs.mm_index & BIT(31)) {
 533            uint32_t idx = s->regs.mm_index & ~BIT(31);
 534            if (idx <= s->vga.vram_size - size) {
 535                stn_le_p(s->vga.vram_ptr + idx, size, data);
 536            }
 537        } else if (s->regs.mm_index > MM_DATA + 3) {
 538            ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);
 539        } else {
 540            qemu_log_mask(LOG_GUEST_ERROR,
 541                "ati_mm_write: mm_index too small: %u\n", s->regs.mm_index);
 542        }
 543        break;
 544    case BIOS_0_SCRATCH ... BUS_CNTL - 1:
 545    {
 546        int i = (addr - BIOS_0_SCRATCH) / 4;
 547        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF && i > 3) {
 548            break;
 549        }
 550        ati_reg_write_offs(&s->regs.bios_scratch[i],
 551                           addr - (BIOS_0_SCRATCH + i * 4), data, size);
 552        break;
 553    }
 554    case GEN_INT_CNTL:
 555        s->regs.gen_int_cntl = data;
 556        if (data & CRTC_VBLANK_INT) {
 557            ati_vga_vblank_irq(s);
 558        } else {
 559            timer_del(&s->vblank_timer);
 560            ati_vga_update_irq(s);
 561        }
 562        break;
 563    case GEN_INT_STATUS:
 564        data &= (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF ?
 565                 0x000f040fUL : 0xfc080effUL);
 566        s->regs.gen_int_status &= ~data;
 567        ati_vga_update_irq(s);
 568        break;
 569    case CRTC_GEN_CNTL ... CRTC_GEN_CNTL + 3:
 570    {
 571        uint32_t val = s->regs.crtc_gen_cntl;
 572        ati_reg_write_offs(&s->regs.crtc_gen_cntl,
 573                           addr - CRTC_GEN_CNTL, data, size);
 574        if ((val & CRTC2_CUR_EN) != (s->regs.crtc_gen_cntl & CRTC2_CUR_EN)) {
 575            if (s->cursor_guest_mode) {
 576                s->vga.force_shadow = !!(s->regs.crtc_gen_cntl & CRTC2_CUR_EN);
 577            } else {
 578                if (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) {
 579                    ati_cursor_define(s);
 580                }
 581                dpy_mouse_set(s->vga.con, s->regs.cur_hv_pos >> 16,
 582                              s->regs.cur_hv_pos & 0xffff,
 583                              (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) != 0);
 584            }
 585        }
 586        if ((val & (CRTC2_EXT_DISP_EN | CRTC2_EN)) !=
 587            (s->regs.crtc_gen_cntl & (CRTC2_EXT_DISP_EN | CRTC2_EN))) {
 588            ati_vga_switch_mode(s);
 589        }
 590        break;
 591    }
 592    case CRTC_EXT_CNTL ... CRTC_EXT_CNTL + 3:
 593    {
 594        uint32_t val = s->regs.crtc_ext_cntl;
 595        ati_reg_write_offs(&s->regs.crtc_ext_cntl,
 596                           addr - CRTC_EXT_CNTL, data, size);
 597        if (s->regs.crtc_ext_cntl & CRT_CRTC_DISPLAY_DIS) {
 598            DPRINTF("Display disabled\n");
 599            s->vga.ar_index &= ~BIT(5);
 600        } else {
 601            DPRINTF("Display enabled\n");
 602            s->vga.ar_index |= BIT(5);
 603            ati_vga_switch_mode(s);
 604        }
 605        if ((val & CRT_CRTC_DISPLAY_DIS) !=
 606            (s->regs.crtc_ext_cntl & CRT_CRTC_DISPLAY_DIS)) {
 607            ati_vga_switch_mode(s);
 608        }
 609        break;
 610    }
 611    case DAC_CNTL:
 612        s->regs.dac_cntl = data & 0xffffe3ff;
 613        s->vga.dac_8bit = !!(data & DAC_8BIT_EN);
 614        break;
 615    case GPIO_VGA_DDC:
 616        if (s->dev_id != PCI_DEVICE_ID_ATI_RAGE128_PF) {
 617            /* FIXME: Maybe add a property to select VGA or DVI port? */
 618        }
 619        break;
 620    case GPIO_DVI_DDC:
 621        if (s->dev_id != PCI_DEVICE_ID_ATI_RAGE128_PF) {
 622            s->regs.gpio_dvi_ddc = ati_i2c(&s->bbi2c, data, 0);
 623        }
 624        break;
 625    case GPIO_MONID ... GPIO_MONID + 3:
 626        /* FIXME What does Radeon have here? */
 627        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 628            ati_reg_write_offs(&s->regs.gpio_monid,
 629                               addr - GPIO_MONID, data, size);
 630            /*
 631             * Rage128p accesses DDC used to get EDID via these bits.
 632             * Because some drivers access this via multiple byte writes
 633             * we have to be careful when we send bits to avoid spurious
 634             * changes in bitbang_i2c state. So only do it when mask is set
 635             * and either the enable bits are changed or output bits changed
 636             * while enabled.
 637             */
 638            if ((s->regs.gpio_monid & BIT(25)) &&
 639                ((addr <= GPIO_MONID + 2 && addr + size > GPIO_MONID + 2) ||
 640                 (addr == GPIO_MONID && (s->regs.gpio_monid & 0x60000)))) {
 641                s->regs.gpio_monid = ati_i2c(&s->bbi2c, s->regs.gpio_monid, 1);
 642            }
 643        }
 644        break;
 645    case PALETTE_INDEX ... PALETTE_INDEX + 3:
 646        if (size == 4) {
 647            vga_ioport_write(&s->vga, VGA_PEL_IR, (data >> 16) & 0xff);
 648            vga_ioport_write(&s->vga, VGA_PEL_IW, data & 0xff);
 649        } else {
 650            if (addr == PALETTE_INDEX) {
 651                vga_ioport_write(&s->vga, VGA_PEL_IW, data & 0xff);
 652            } else {
 653                vga_ioport_write(&s->vga, VGA_PEL_IR, data & 0xff);
 654            }
 655        }
 656        break;
 657    case PALETTE_DATA ... PALETTE_DATA + 3:
 658        data <<= addr - PALETTE_DATA;
 659        data = bswap32(data) >> 8;
 660        vga_ioport_write(&s->vga, VGA_PEL_D, data & 0xff);
 661        data >>= 8;
 662        vga_ioport_write(&s->vga, VGA_PEL_D, data & 0xff);
 663        data >>= 8;
 664        vga_ioport_write(&s->vga, VGA_PEL_D, data & 0xff);
 665        break;
 666    case CNFG_CNTL:
 667        s->regs.config_cntl = data;
 668        break;
 669    case CRTC_H_TOTAL_DISP:
 670        s->regs.crtc_h_total_disp = data & 0x07ff07ff;
 671        break;
 672    case CRTC_H_SYNC_STRT_WID:
 673        s->regs.crtc_h_sync_strt_wid = data & 0x17bf1fff;
 674        break;
 675    case CRTC_V_TOTAL_DISP:
 676        s->regs.crtc_v_total_disp = data & 0x0fff0fff;
 677        break;
 678    case CRTC_V_SYNC_STRT_WID:
 679        s->regs.crtc_v_sync_strt_wid = data & 0x9f0fff;
 680        break;
 681    case CRTC_OFFSET:
 682        s->regs.crtc_offset = data & 0xc7ffffff;
 683        break;
 684    case CRTC_OFFSET_CNTL:
 685        s->regs.crtc_offset_cntl = data; /* FIXME */
 686        break;
 687    case CRTC_PITCH:
 688        s->regs.crtc_pitch = data & 0x07ff07ff;
 689        break;
 690    case 0xf00 ... 0xfff:
 691        /* read-only copy of PCI config space so ignore writes */
 692        break;
 693    case CUR_OFFSET ... CUR_OFFSET + 3:
 694    {
 695        uint32_t t = s->regs.cur_offset;
 696
 697        ati_reg_write_offs(&t, addr - CUR_OFFSET, data, size);
 698        t &= 0x87fffff0;
 699        if (s->regs.cur_offset != t) {
 700            s->regs.cur_offset = t;
 701            ati_cursor_define(s);
 702        }
 703        break;
 704    }
 705    case CUR_HORZ_VERT_POSN ... CUR_HORZ_VERT_POSN + 3:
 706    {
 707        uint32_t t = s->regs.cur_hv_pos | (s->regs.cur_offset & BIT(31));
 708
 709        ati_reg_write_offs(&t, addr - CUR_HORZ_VERT_POSN, data, size);
 710        s->regs.cur_hv_pos = t & 0x3fff0fff;
 711        if (t & BIT(31)) {
 712            s->regs.cur_offset |= t & BIT(31);
 713        } else if (s->regs.cur_offset & BIT(31)) {
 714            s->regs.cur_offset &= ~BIT(31);
 715            ati_cursor_define(s);
 716        }
 717        if (!s->cursor_guest_mode &&
 718            (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) && !(t & BIT(31))) {
 719            dpy_mouse_set(s->vga.con, s->regs.cur_hv_pos >> 16,
 720                          s->regs.cur_hv_pos & 0xffff, 1);
 721        }
 722        break;
 723    }
 724    case CUR_HORZ_VERT_OFF:
 725    {
 726        uint32_t t = s->regs.cur_hv_offs | (s->regs.cur_offset & BIT(31));
 727
 728        ati_reg_write_offs(&t, addr - CUR_HORZ_VERT_OFF, data, size);
 729        s->regs.cur_hv_offs = t & 0x3f003f;
 730        if (t & BIT(31)) {
 731            s->regs.cur_offset |= t & BIT(31);
 732        } else if (s->regs.cur_offset & BIT(31)) {
 733            s->regs.cur_offset &= ~BIT(31);
 734            ati_cursor_define(s);
 735        }
 736        break;
 737    }
 738    case CUR_CLR0 ... CUR_CLR0 + 3:
 739    {
 740        uint32_t t = s->regs.cur_color0;
 741
 742        ati_reg_write_offs(&t, addr - CUR_CLR0, data, size);
 743        t &= 0xffffff;
 744        if (s->regs.cur_color0 != t) {
 745            s->regs.cur_color0 = t;
 746            ati_cursor_define(s);
 747        }
 748        break;
 749    }
 750    case CUR_CLR1 ... CUR_CLR1 + 3:
 751        /*
 752         * Update cursor unconditionally here because some clients set up
 753         * other registers before actually writing cursor data to memory at
 754         * offset so we would miss cursor change unless always updating here
 755         */
 756        ati_reg_write_offs(&s->regs.cur_color1, addr - CUR_CLR1, data, size);
 757        s->regs.cur_color1 &= 0xffffff;
 758        ati_cursor_define(s);
 759        break;
 760    case DST_OFFSET:
 761        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 762            s->regs.dst_offset = data & 0xfffffff0;
 763        } else {
 764            s->regs.dst_offset = data & 0xfffffc00;
 765        }
 766        break;
 767    case DST_PITCH:
 768        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 769            s->regs.dst_pitch = data & 0x3fff;
 770            s->regs.dst_tile = (data >> 16) & 1;
 771        } else {
 772            s->regs.dst_pitch = data & 0x3ff0;
 773        }
 774        break;
 775    case DST_TILE:
 776        if (s->dev_id == PCI_DEVICE_ID_ATI_RADEON_QY) {
 777            s->regs.dst_tile = data & 3;
 778        }
 779        break;
 780    case DST_WIDTH:
 781        s->regs.dst_width = data & 0x3fff;
 782        ati_2d_blt(s);
 783        break;
 784    case DST_HEIGHT:
 785        s->regs.dst_height = data & 0x3fff;
 786        break;
 787    case SRC_X:
 788        s->regs.src_x = data & 0x3fff;
 789        break;
 790    case SRC_Y:
 791        s->regs.src_y = data & 0x3fff;
 792        break;
 793    case DST_X:
 794        s->regs.dst_x = data & 0x3fff;
 795        break;
 796    case DST_Y:
 797        s->regs.dst_y = data & 0x3fff;
 798        break;
 799    case SRC_PITCH_OFFSET:
 800        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 801            s->regs.src_offset = (data & 0x1fffff) << 5;
 802            s->regs.src_pitch = (data & 0x7fe00000) >> 21;
 803            s->regs.src_tile = data >> 31;
 804        } else {
 805            s->regs.src_offset = (data & 0x3fffff) << 10;
 806            s->regs.src_pitch = (data & 0x3fc00000) >> 16;
 807            s->regs.src_tile = (data >> 30) & 1;
 808        }
 809        break;
 810    case DST_PITCH_OFFSET:
 811        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 812            s->regs.dst_offset = (data & 0x1fffff) << 5;
 813            s->regs.dst_pitch = (data & 0x7fe00000) >> 21;
 814            s->regs.dst_tile = data >> 31;
 815        } else {
 816            s->regs.dst_offset = (data & 0x3fffff) << 10;
 817            s->regs.dst_pitch = (data & 0x3fc00000) >> 16;
 818            s->regs.dst_tile = data >> 30;
 819        }
 820        break;
 821    case SRC_Y_X:
 822        s->regs.src_x = data & 0x3fff;
 823        s->regs.src_y = (data >> 16) & 0x3fff;
 824        break;
 825    case DST_Y_X:
 826        s->regs.dst_x = data & 0x3fff;
 827        s->regs.dst_y = (data >> 16) & 0x3fff;
 828        break;
 829    case DST_HEIGHT_WIDTH:
 830        s->regs.dst_width = data & 0x3fff;
 831        s->regs.dst_height = (data >> 16) & 0x3fff;
 832        ati_2d_blt(s);
 833        break;
 834    case DP_GUI_MASTER_CNTL:
 835        s->regs.dp_gui_master_cntl = data & 0xf800000f;
 836        s->regs.dp_datatype = (data & 0x0f00) >> 8 | (data & 0x30f0) << 4 |
 837                              (data & 0x4000) << 16;
 838        s->regs.dp_mix = (data & GMC_ROP3_MASK) | (data & 0x7000000) >> 16;
 839        break;
 840    case DST_WIDTH_X:
 841        s->regs.dst_x = data & 0x3fff;
 842        s->regs.dst_width = (data >> 16) & 0x3fff;
 843        ati_2d_blt(s);
 844        break;
 845    case SRC_X_Y:
 846        s->regs.src_y = data & 0x3fff;
 847        s->regs.src_x = (data >> 16) & 0x3fff;
 848        break;
 849    case DST_X_Y:
 850        s->regs.dst_y = data & 0x3fff;
 851        s->regs.dst_x = (data >> 16) & 0x3fff;
 852        break;
 853    case DST_WIDTH_HEIGHT:
 854        s->regs.dst_height = data & 0x3fff;
 855        s->regs.dst_width = (data >> 16) & 0x3fff;
 856        ati_2d_blt(s);
 857        break;
 858    case DST_HEIGHT_Y:
 859        s->regs.dst_y = data & 0x3fff;
 860        s->regs.dst_height = (data >> 16) & 0x3fff;
 861        break;
 862    case SRC_OFFSET:
 863        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 864            s->regs.src_offset = data & 0xfffffff0;
 865        } else {
 866            s->regs.src_offset = data & 0xfffffc00;
 867        }
 868        break;
 869    case SRC_PITCH:
 870        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 871            s->regs.src_pitch = data & 0x3fff;
 872            s->regs.src_tile = (data >> 16) & 1;
 873        } else {
 874            s->regs.src_pitch = data & 0x3ff0;
 875        }
 876        break;
 877    case DP_BRUSH_BKGD_CLR:
 878        s->regs.dp_brush_bkgd_clr = data;
 879        break;
 880    case DP_BRUSH_FRGD_CLR:
 881        s->regs.dp_brush_frgd_clr = data;
 882        break;
 883    case DP_CNTL:
 884        s->regs.dp_cntl = data;
 885        break;
 886    case DP_DATATYPE:
 887        s->regs.dp_datatype = data & 0xe0070f0f;
 888        break;
 889    case DP_MIX:
 890        s->regs.dp_mix = data & 0x00ff0700;
 891        break;
 892    case DP_WRITE_MASK:
 893        s->regs.dp_write_mask = data;
 894        break;
 895    case DEFAULT_OFFSET:
 896        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 897            s->regs.default_offset = data & 0xfffffff0;
 898        } else {
 899            /* Radeon has DEFAULT_PITCH_OFFSET here like DST_PITCH_OFFSET */
 900            s->regs.default_offset = (data & 0x3fffff) << 10;
 901            s->regs.default_pitch = (data & 0x3fc00000) >> 16;
 902            s->regs.default_tile = data >> 30;
 903        }
 904        break;
 905    case DEFAULT_PITCH:
 906        if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 907            s->regs.default_pitch = data & 0x3fff;
 908            s->regs.default_tile = (data >> 16) & 1;
 909        }
 910        break;
 911    case DEFAULT_SC_BOTTOM_RIGHT:
 912        s->regs.default_sc_bottom_right = data & 0x3fff3fff;
 913        break;
 914    default:
 915        break;
 916    }
 917}
 918
 919static const MemoryRegionOps ati_mm_ops = {
 920    .read = ati_mm_read,
 921    .write = ati_mm_write,
 922    .endianness = DEVICE_LITTLE_ENDIAN,
 923};
 924
 925static void ati_vga_realize(PCIDevice *dev, Error **errp)
 926{
 927    ATIVGAState *s = ATI_VGA(dev);
 928    VGACommonState *vga = &s->vga;
 929
 930    if (s->model) {
 931        int i;
 932        for (i = 0; i < ARRAY_SIZE(ati_model_aliases); i++) {
 933            if (!strcmp(s->model, ati_model_aliases[i].name)) {
 934                s->dev_id = ati_model_aliases[i].dev_id;
 935                break;
 936            }
 937        }
 938        if (i >= ARRAY_SIZE(ati_model_aliases)) {
 939            warn_report("Unknown ATI VGA model name, "
 940                        "using default rage128p");
 941        }
 942    }
 943    if (s->dev_id != PCI_DEVICE_ID_ATI_RAGE128_PF &&
 944        s->dev_id != PCI_DEVICE_ID_ATI_RADEON_QY) {
 945        error_setg(errp, "Unknown ATI VGA device id, "
 946                   "only 0x5046 and 0x5159 are supported");
 947        return;
 948    }
 949    pci_set_word(dev->config + PCI_DEVICE_ID, s->dev_id);
 950
 951    if (s->dev_id == PCI_DEVICE_ID_ATI_RADEON_QY &&
 952        s->vga.vram_size_mb < 16) {
 953        warn_report("Too small video memory for device id");
 954        s->vga.vram_size_mb = 16;
 955    }
 956
 957    /* init vga bits */
 958    if (!vga_common_init(vga, OBJECT(s), errp)) {
 959        return;
 960    }
 961    vga_init(vga, OBJECT(s), pci_address_space(dev),
 962             pci_address_space_io(dev), true);
 963    vga->con = graphic_console_init(DEVICE(s), 0, s->vga.hw_ops, &s->vga);
 964    if (s->cursor_guest_mode) {
 965        vga->cursor_invalidate = ati_cursor_invalidate;
 966        vga->cursor_draw_line = ati_cursor_draw_line;
 967    }
 968
 969    /* ddc, edid */
 970    I2CBus *i2cbus = i2c_init_bus(DEVICE(s), "ati-vga.ddc");
 971    bitbang_i2c_init(&s->bbi2c, i2cbus);
 972    I2CSlave *i2cddc = I2C_SLAVE(qdev_new(TYPE_I2CDDC));
 973    i2c_slave_set_address(i2cddc, 0x50);
 974    qdev_realize_and_unref(DEVICE(i2cddc), BUS(i2cbus), &error_abort);
 975
 976    /* mmio register space */
 977    memory_region_init_io(&s->mm, OBJECT(s), &ati_mm_ops, s,
 978                          "ati.mmregs", 0x4000);
 979    /* io space is alias to beginning of mmregs */
 980    memory_region_init_alias(&s->io, OBJECT(s), "ati.io", &s->mm, 0, 0x100);
 981
 982    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &vga->vram);
 983    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
 984    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mm);
 985
 986    /* most interrupts are not yet emulated but MacOS needs at least VBlank */
 987    dev->config[PCI_INTERRUPT_PIN] = 1;
 988    timer_init_ns(&s->vblank_timer, QEMU_CLOCK_VIRTUAL, ati_vga_vblank_irq, s);
 989}
 990
 991static void ati_vga_reset(DeviceState *dev)
 992{
 993    ATIVGAState *s = ATI_VGA(dev);
 994
 995    timer_del(&s->vblank_timer);
 996    ati_vga_update_irq(s);
 997
 998    /* reset vga */
 999    vga_common_reset(&s->vga);
1000    s->mode = VGA_MODE;
1001}
1002
1003static void ati_vga_exit(PCIDevice *dev)
1004{
1005    ATIVGAState *s = ATI_VGA(dev);
1006
1007    timer_del(&s->vblank_timer);
1008    graphic_console_close(s->vga.con);
1009}
1010
1011static Property ati_vga_properties[] = {
1012    DEFINE_PROP_UINT32("vgamem_mb", ATIVGAState, vga.vram_size_mb, 16),
1013    DEFINE_PROP_STRING("model", ATIVGAState, model),
1014    DEFINE_PROP_UINT16("x-device-id", ATIVGAState, dev_id,
1015                       PCI_DEVICE_ID_ATI_RAGE128_PF),
1016    DEFINE_PROP_BOOL("guest_hwcursor", ATIVGAState, cursor_guest_mode, false),
1017    DEFINE_PROP_END_OF_LIST()
1018};
1019
1020static void ati_vga_class_init(ObjectClass *klass, void *data)
1021{
1022    DeviceClass *dc = DEVICE_CLASS(klass);
1023    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1024
1025    dc->reset = ati_vga_reset;
1026    device_class_set_props(dc, ati_vga_properties);
1027    dc->hotpluggable = false;
1028    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
1029
1030    k->class_id = PCI_CLASS_DISPLAY_VGA;
1031    k->vendor_id = PCI_VENDOR_ID_ATI;
1032    k->device_id = PCI_DEVICE_ID_ATI_RAGE128_PF;
1033    k->romfile = "vgabios-ati.bin";
1034    k->realize = ati_vga_realize;
1035    k->exit = ati_vga_exit;
1036}
1037
1038static const TypeInfo ati_vga_info = {
1039    .name = TYPE_ATI_VGA,
1040    .parent = TYPE_PCI_DEVICE,
1041    .instance_size = sizeof(ATIVGAState),
1042    .class_init = ati_vga_class_init,
1043    .interfaces = (InterfaceInfo[]) {
1044          { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1045          { },
1046    },
1047};
1048
1049static void ati_vga_register_types(void)
1050{
1051    type_register_static(&ati_vga_info);
1052}
1053
1054type_init(ati_vga_register_types)
1055