hw/display/ati.c

   1 /*
   2  * QEMU ATI SVGA emulation
   3  *
   4  * Copyright (c) 2019 BALATON Zoltan
   5  *
   6  * This work is licensed under the GNU GPL license version 2 or later.
   7  */
   8
   9 /*
  10  * WARNING:
  11  * This is very incomplete and only enough for Linux console and some
  12  * unaccelerated X output at the moment.
  13  * Currently it's little more than a frame buffer with minimal functions,
  14  * other more advanced features of the hardware are yet to be implemented.
  15  * We only aim for Rage 128 Pro (and some RV100) and 2D only at first,
  16  * No 3D at all yet (maybe after 2D works, but feel free to improve it)
  17  */
  18
  19 #include "ati_int.h"
  20 #include "ati_regs.h"
  21 #include "vga_regs.h"
  22 #include "qemu/log.h"
  23 #include "qemu/error-report.h"
  24 #include "qapi/error.h"
  25 #include "hw/hw.h"
  26 #include "ui/console.h"
  27 #include "trace.h"
  28
  29 #define ATI_DEBUG_HW_CURSOR 0
  30
  31 static const struct {
  32     const char *name;
  33     uint16_t dev_id;
  34 } ati_model_aliases[] = {
  35     { "rage128p", PCI_DEVICE_ID_ATI_RAGE128_PF },
  36     { "rv100", PCI_DEVICE_ID_ATI_RADEON_QY },
  37 };
  38
  39 enum { VGA_MODE, EXT_MODE };
  40
  41 static void ati_vga_switch_mode(ATIVGAState *s)
  42 {
  43     DPRINTF("%d -> %d\n",
  44             s->mode, !!(s->regs.crtc_gen_cntl & CRTC2_EXT_DISP_EN));
  45     if (s->regs.crtc_gen_cntl & CRTC2_EXT_DISP_EN) {
  46         /* Extended mode enabled */
  47         s->mode = EXT_MODE;
  48         if (s->regs.crtc_gen_cntl & CRTC2_EN) {
  49             /* CRT controller enabled, use CRTC values */
  50             uint32_t offs = s->regs.crtc_offset & 0x07ffffff;
  51             int stride = (s->regs.crtc_pitch & 0x7ff) * 8;
  52             int bpp = 0;
  53             int h, v;
  54
  55             if (s->regs.crtc_h_total_disp == 0) {
  56                 s->regs.crtc_h_total_disp = ((640 / 8) - 1) << 16;
  57             }
  58             if (s->regs.crtc_v_total_disp == 0) {
  59                 s->regs.crtc_v_total_disp = (480 - 1) << 16;
  60             }
  61             h = ((s->regs.crtc_h_total_disp >> 16) + 1) * 8;
  62             v = (s->regs.crtc_v_total_disp >> 16) + 1;
  63             switch (s->regs.crtc_gen_cntl & CRTC_PIX_WIDTH_MASK) {
  64             case CRTC_PIX_WIDTH_4BPP:
  65                 bpp = 4;
  66                 break;
  67             case CRTC_PIX_WIDTH_8BPP:
  68                 bpp = 8;
  69                 break;
  70             case CRTC_PIX_WIDTH_15BPP:
  71                 bpp = 15;
  72                 break;
  73             case CRTC_PIX_WIDTH_16BPP:
  74                 bpp = 16;
  75                 break;
  76             case CRTC_PIX_WIDTH_24BPP:
  77                 bpp = 24;
  78                 break;
  79             case CRTC_PIX_WIDTH_32BPP:
  80                 bpp = 32;
  81                 break;
  82             default:
  83                 qemu_log_mask(LOG_UNIMP, "Unsupported bpp value\n");
  84             }
  85             assert(bpp != 0);
  86             DPRINTF("Switching to %dx%d %d %d @ %x\n", h, v, stride, bpp, offs);
  87             vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_ENABLE);
  88             vbe_ioport_write_data(&s->vga, 0, VBE_DISPI_DISABLED);
  89             /* reset VBE regs then set up mode */
  90             s->vga.vbe_regs[VBE_DISPI_INDEX_XRES] = h;
  91             s->vga.vbe_regs[VBE_DISPI_INDEX_YRES] = v;
  92             s->vga.vbe_regs[VBE_DISPI_INDEX_BPP] = bpp;
  93             /* enable mode via ioport so it updates vga regs */
  94             vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_ENABLE);
  95             vbe_ioport_write_data(&s->vga, 0, VBE_DISPI_ENABLED |
  96                 VBE_DISPI_LFB_ENABLED | VBE_DISPI_NOCLEARMEM |
  97                 (s->regs.dac_cntl & DAC_8BIT_EN ? VBE_DISPI_8BIT_DAC : 0));
  98             /* now set offset and stride after enable as that resets these */
  99             if (stride) {
 100                 vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_VIRT_WIDTH);
 101                 vbe_ioport_write_data(&s->vga, 0, stride);
 102                 if (offs % stride == 0) {
 103                     vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_Y_OFFSET);
 104                     vbe_ioport_write_data(&s->vga, 0, offs / stride);
 105                 } else {
 106                     /* FIXME what to do with this? */
 107                     error_report("VGA offset is not multiple of pitch, "
 108                                  "expect bad picture");
 109                 }
 110             }
 111         }
 112     } else {
 113         /* VGA mode enabled */
 114         s->mode = VGA_MODE;
 115         vbe_ioport_write_index(&s->vga, 0, VBE_DISPI_INDEX_ENABLE);
 116         vbe_ioport_write_data(&s->vga, 0, VBE_DISPI_DISABLED);
 117     }
 118 }
 119
 120 /* Used by host side hardware cursor */
 121 static void ati_cursor_define(ATIVGAState *s)
 122 {
 123     uint8_t data[1024];
 124     uint8_t *src;
 125     int i, j, idx = 0;
 126
 127     if ((s->regs.cur_offset & BIT(31)) || s->cursor_guest_mode) {
 128         return; /* Do not update cursor if locked or rendered by guest */
 129     }
 130     /* FIXME handle cur_hv_offs correctly */
 131     src = s->vga.vram_ptr + (s->regs.crtc_offset & 0x07ffffff) +
 132           s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
 133           (s->regs.cur_hv_offs & 0xffff) * 16;
 134     for (i = 0; i < 64; i++) {
 135         for (j = 0; j < 8; j++, idx++) {
 136             data[idx] = src[i * 16 + j];
 137             data[512 + idx] = src[i * 16 + j + 8];
 138         }
 139     }
 140     if (!s->cursor) {
 141         s->cursor = cursor_alloc(64, 64);
 142     }
 143     cursor_set_mono(s->cursor, s->regs.cur_color1, s->regs.cur_color0,
 144                     &data[512], 1, &data[0]);
 145     dpy_cursor_define(s->vga.con, s->cursor);
 146 }
 147
 148 /* Alternatively support guest rendered hardware cursor */
 149 static void ati_cursor_invalidate(VGACommonState *vga)
 150 {
 151     ATIVGAState *s = container_of(vga, ATIVGAState, vga);
 152     int size = (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) ? 64 : 0;
 153
 154     if (s->regs.cur_offset & BIT(31)) {
 155         return; /* Do not update cursor if locked */
 156     }
 157     if (s->cursor_size != size ||
 158         vga->hw_cursor_x != s->regs.cur_hv_pos >> 16 ||
 159         vga->hw_cursor_y != (s->regs.cur_hv_pos & 0xffff) ||
 160         s->cursor_offset != s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
 161         (s->regs.cur_hv_offs & 0xffff) * 16) {
 162         /* Remove old cursor then update and show new one if needed */
 163         vga_invalidate_scanlines(vga, vga->hw_cursor_y, vga->hw_cursor_y + 63);
 164         vga->hw_cursor_x = s->regs.cur_hv_pos >> 16;
 165         vga->hw_cursor_y = s->regs.cur_hv_pos & 0xffff;
 166         s->cursor_offset = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
 167                            (s->regs.cur_hv_offs & 0xffff) * 16;
 168         s->cursor_size = size;
 169         if (size) {
 170             vga_invalidate_scanlines(vga,
 171                                      vga->hw_cursor_y, vga->hw_cursor_y + 63);
 172         }
 173     }
 174 }
 175
 176 static void ati_cursor_draw_line(VGACommonState *vga, uint8_t *d, int scr_y)
 177 {
 178     ATIVGAState *s = container_of(vga, ATIVGAState, vga);
 179     uint8_t *src;
 180     uint32_t *dp = (uint32_t *)d;
 181     int i, j, h;
 182
 183     if (!(s->regs.crtc_gen_cntl & CRTC2_CUR_EN) ||
 184         scr_y < vga->hw_cursor_y || scr_y >= vga->hw_cursor_y + 64 ||
 185         scr_y > s->regs.crtc_v_total_disp >> 16) {
 186         return;
 187     }
 188     /* FIXME handle cur_hv_offs correctly */
 189     src = s->vga.vram_ptr + (s->regs.crtc_offset & 0x07ffffff) +
 190           s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16;
 191     dp = &dp[vga->hw_cursor_x];
 192     h = ((s->regs.crtc_h_total_disp >> 16) + 1) * 8;
 193     for (i = 0; i < 8; i++) {
 194         uint32_t color;
 195         uint8_t abits = src[i];
 196         uint8_t xbits = src[i + 8];
 197         for (j = 0; j < 8; j++, abits <<= 1, xbits <<= 1) {
 198             if (abits & BIT(7)) {
 199                 if (xbits & BIT(7)) {
 200                     color = dp[i * 8 + j] ^ 0xffffffff; /* complement */
 201                 } else {
 202                     continue; /* transparent, no change */
 203                 }
 204             } else {
 205                 color = (xbits & BIT(7) ? s->regs.cur_color1 :
 206                                           s->regs.cur_color0) << 8 | 0xff;
 207             }
 208             if (vga->hw_cursor_x + i * 8 + j >= h) {
 209                 return; /* end of screen, don't span to next line */
 210             }
 211             dp[i * 8 + j] = color;
 212         }
 213     }
 214 }
 215
 216 static inline uint64_t ati_reg_read_offs(uint32_t reg, int offs,
 217                                          unsigned int size)
 218 {
 219     if (offs == 0 && size == 4) {
 220         return reg;
 221     } else {
 222         return extract32(reg, offs * BITS_PER_BYTE, size * BITS_PER_BYTE);
 223     }
 224 }
 225
 226 static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
 227 {
 228     ATIVGAState *s = opaque;
 229     uint64_t val = 0;
 230
 231     switch (addr) {
 232     case MM_INDEX:
 233         val = s->regs.mm_index;
 234         break;
 235     case MM_DATA ... MM_DATA + 3:
 236         /* indexed access to regs or memory */
 237         if (s->regs.mm_index & BIT(31)) {
 238             if (s->regs.mm_index <= s->vga.vram_size - size) {
 239                 int i = size - 1;
 240                 while (i >= 0) {
 241                     val <<= 8;
 242                     val |= s->vga.vram_ptr[s->regs.mm_index + i--];
 243                 }
 244             }
 245         } else {
 246             val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);
 247         }
 248         break;
 249     case BIOS_0_SCRATCH ... BUS_CNTL - 1:
 250     {
 251         int i = (addr - BIOS_0_SCRATCH) / 4;
 252         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF && i > 3) {
 253             break;
 254         }
 255         val = ati_reg_read_offs(s->regs.bios_scratch[i],
 256                                 addr - (BIOS_0_SCRATCH + i * 4), size);
 257         break;
 258     }
 259     case CRTC_GEN_CNTL ... CRTC_GEN_CNTL + 3:
 260         val = ati_reg_read_offs(s->regs.crtc_gen_cntl,
 261                                 addr - CRTC_GEN_CNTL, size);
 262         break;
 263     case CRTC_EXT_CNTL ... CRTC_EXT_CNTL + 3:
 264         val = ati_reg_read_offs(s->regs.crtc_ext_cntl,
 265                                 addr - CRTC_EXT_CNTL, size);
 266         break;
 267     case DAC_CNTL:
 268         val = s->regs.dac_cntl;
 269         break;
 270 /*    case GPIO_MONID: FIXME hook up DDC I2C here */
 271     case PALETTE_INDEX:
 272         /* FIXME unaligned access */
 273         val = vga_ioport_read(&s->vga, VGA_PEL_IR) << 16;
 274         val |= vga_ioport_read(&s->vga, VGA_PEL_IW) & 0xff;
 275         break;
 276     case PALETTE_DATA:
 277         val = vga_ioport_read(&s->vga, VGA_PEL_D);
 278         break;
 279     case CNFG_MEMSIZE:
 280         val = s->vga.vram_size;
 281         break;
 282     case MC_STATUS:
 283         val = 5;
 284         break;
 285     case RBBM_STATUS:
 286     case GUI_STAT:
 287         val = 64; /* free CMDFIFO entries */
 288         break;
 289     case CRTC_H_TOTAL_DISP:
 290         val = s->regs.crtc_h_total_disp;
 291         break;
 292     case CRTC_H_SYNC_STRT_WID:
 293         val = s->regs.crtc_h_sync_strt_wid;
 294         break;
 295     case CRTC_V_TOTAL_DISP:
 296         val = s->regs.crtc_v_total_disp;
 297         break;
 298     case CRTC_V_SYNC_STRT_WID:
 299         val = s->regs.crtc_v_sync_strt_wid;
 300         break;
 301     case CRTC_OFFSET:
 302         val = s->regs.crtc_offset;
 303         break;
 304     case CRTC_OFFSET_CNTL:
 305         val = s->regs.crtc_offset_cntl;
 306         break;
 307     case CRTC_PITCH:
 308         val = s->regs.crtc_pitch;
 309         break;
 310     case 0xf00 ... 0xfff:
 311         val = pci_default_read_config(&s->dev, addr - 0xf00, size);
 312         break;
 313     case CUR_OFFSET:
 314         val = s->regs.cur_offset;
 315         break;
 316     case CUR_HORZ_VERT_POSN:
 317         val = s->regs.cur_hv_pos;
 318         val |= s->regs.cur_offset & BIT(31);
 319         break;
 320     case CUR_HORZ_VERT_OFF:
 321         val = s->regs.cur_hv_offs;
 322         val |= s->regs.cur_offset & BIT(31);
 323         break;
 324     case CUR_CLR0:
 325         val = s->regs.cur_color0;
 326         break;
 327     case CUR_CLR1:
 328         val = s->regs.cur_color1;
 329         break;
 330     case DST_OFFSET:
 331         val = s->regs.dst_offset;
 332         break;
 333     case DST_PITCH:
 334         val = s->regs.dst_pitch;
 335         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 336             val &= s->regs.dst_tile << 16;
 337         }
 338         break;
 339     case DST_WIDTH:
 340         val = s->regs.dst_width;
 341         break;
 342     case DST_HEIGHT:
 343         val = s->regs.dst_height;
 344         break;
 345     case SRC_X:
 346         val = s->regs.src_x;
 347         break;
 348     case SRC_Y:
 349         val = s->regs.src_y;
 350         break;
 351     case DST_X:
 352         val = s->regs.dst_x;
 353         break;
 354     case DST_Y:
 355         val = s->regs.dst_y;
 356         break;
 357     case DP_GUI_MASTER_CNTL:
 358         val = s->regs.dp_gui_master_cntl;
 359         break;
 360     case SRC_OFFSET:
 361         val = s->regs.src_offset;
 362         break;
 363     case SRC_PITCH:
 364         val = s->regs.src_pitch;
 365         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 366             val &= s->regs.src_tile << 16;
 367         }
 368         break;
 369     case DP_BRUSH_BKGD_CLR:
 370         val = s->regs.dp_brush_bkgd_clr;
 371         break;
 372     case DP_BRUSH_FRGD_CLR:
 373         val = s->regs.dp_brush_frgd_clr;
 374         break;
 375     case DP_SRC_FRGD_CLR:
 376         val = s->regs.dp_src_frgd_clr;
 377         break;
 378     case DP_SRC_BKGD_CLR:
 379         val = s->regs.dp_src_bkgd_clr;
 380         break;
 381     case DP_CNTL:
 382         val = s->regs.dp_cntl;
 383         break;
 384     case DP_DATATYPE:
 385         val = s->regs.dp_datatype;
 386         break;
 387     case DP_MIX:
 388         val = s->regs.dp_mix;
 389         break;
 390     case DP_WRITE_MASK:
 391         val = s->regs.dp_write_mask;
 392         break;
 393     case DEFAULT_OFFSET:
 394         val = s->regs.default_offset;
 395         break;
 396     case DEFAULT_PITCH:
 397         val = s->regs.default_pitch;
 398         break;
 399     case DEFAULT_SC_BOTTOM_RIGHT:
 400         val = s->regs.default_sc_bottom_right;
 401         break;
 402     default:
 403         break;
 404     }
 405     if (addr < CUR_OFFSET || addr > CUR_CLR1 || ATI_DEBUG_HW_CURSOR) {
 406         trace_ati_mm_read(size, addr, ati_reg_name(addr & ~3ULL), val);
 407     }
 408     return val;
 409 }
 410
 411 static inline void ati_reg_write_offs(uint32_t *reg, int offs,
 412                                       uint64_t data, unsigned int size)
 413 {
 414     if (offs == 0 && size == 4) {
 415         *reg = data;
 416     } else {
 417         *reg = deposit32(*reg, offs * BITS_PER_BYTE, size * BITS_PER_BYTE,
 418                          data);
 419     }
 420 }
 421
 422 static void ati_mm_write(void *opaque, hwaddr addr,
 423                            uint64_t data, unsigned int size)
 424 {
 425     ATIVGAState *s = opaque;
 426
 427     if (addr < CUR_OFFSET || addr > CUR_CLR1 || ATI_DEBUG_HW_CURSOR) {
 428         trace_ati_mm_write(size, addr, ati_reg_name(addr & ~3ULL), data);
 429     }
 430     switch (addr) {
 431     case MM_INDEX:
 432         s->regs.mm_index = data;
 433         break;
 434     case MM_DATA ... MM_DATA + 3:
 435         /* indexed access to regs or memory */
 436         if (s->regs.mm_index & BIT(31)) {
 437             if (s->regs.mm_index <= s->vga.vram_size - size) {
 438                 int i = 0;
 439                 while (i < size) {
 440                     s->vga.vram_ptr[s->regs.mm_index + i] = data & 0xff;
 441                     data >>= 8;
 442                 }
 443             }
 444         } else {
 445             ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);
 446         }
 447         break;
 448     case BIOS_0_SCRATCH ... BUS_CNTL - 1:
 449     {
 450         int i = (addr - BIOS_0_SCRATCH) / 4;
 451         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF && i > 3) {
 452             break;
 453         }
 454         ati_reg_write_offs(&s->regs.bios_scratch[i],
 455                            addr - (BIOS_0_SCRATCH + i * 4), data, size);
 456         break;
 457     }
 458     case CRTC_GEN_CNTL ... CRTC_GEN_CNTL + 3:
 459     {
 460         uint32_t val = s->regs.crtc_gen_cntl;
 461         ati_reg_write_offs(&s->regs.crtc_gen_cntl,
 462                            addr - CRTC_GEN_CNTL, data, size);
 463         if ((val & CRTC2_CUR_EN) != (s->regs.crtc_gen_cntl & CRTC2_CUR_EN)) {
 464             if (s->cursor_guest_mode) {
 465                 s->vga.force_shadow = !!(s->regs.crtc_gen_cntl & CRTC2_CUR_EN);
 466             } else {
 467                 if (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) {
 468                     ati_cursor_define(s);
 469                 }
 470                 dpy_mouse_set(s->vga.con, s->regs.cur_hv_pos >> 16,
 471                               s->regs.cur_hv_pos & 0xffff,
 472                               (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) != 0);
 473             }
 474         }
 475         if ((val & (CRTC2_EXT_DISP_EN | CRTC2_EN)) !=
 476             (s->regs.crtc_gen_cntl & (CRTC2_EXT_DISP_EN | CRTC2_EN))) {
 477             ati_vga_switch_mode(s);
 478         }
 479         break;
 480     }
 481     case CRTC_EXT_CNTL ... CRTC_EXT_CNTL + 3:
 482     {
 483         uint32_t val = s->regs.crtc_ext_cntl;
 484         ati_reg_write_offs(&s->regs.crtc_ext_cntl,
 485                            addr - CRTC_EXT_CNTL, data, size);
 486         if (s->regs.crtc_ext_cntl & CRT_CRTC_DISPLAY_DIS) {
 487             DPRINTF("Display disabled\n");
 488             s->vga.ar_index &= ~BIT(5);
 489         } else {
 490             DPRINTF("Display enabled\n");
 491             s->vga.ar_index |= BIT(5);
 492             ati_vga_switch_mode(s);
 493         }
 494         if ((val & CRT_CRTC_DISPLAY_DIS) !=
 495             (s->regs.crtc_ext_cntl & CRT_CRTC_DISPLAY_DIS)) {
 496             ati_vga_switch_mode(s);
 497         }
 498         break;
 499     }
 500     case DAC_CNTL:
 501         s->regs.dac_cntl = data & 0xffffe3ff;
 502         s->vga.dac_8bit = !!(data & DAC_8BIT_EN);
 503         break;
 504 /*    case GPIO_MONID: FIXME hook up DDC I2C here */
 505     case PALETTE_INDEX ... PALETTE_INDEX + 3:
 506         if (size == 4) {
 507             vga_ioport_write(&s->vga, VGA_PEL_IR, (data >> 16) & 0xff);
 508             vga_ioport_write(&s->vga, VGA_PEL_IW, data & 0xff);
 509         } else {
 510             if (addr == PALETTE_INDEX) {
 511                 vga_ioport_write(&s->vga, VGA_PEL_IW, data & 0xff);
 512             } else {
 513                 vga_ioport_write(&s->vga, VGA_PEL_IR, data & 0xff);
 514             }
 515         }
 516         break;
 517     case PALETTE_DATA ... PALETTE_DATA + 3:
 518         data <<= addr - PALETTE_DATA;
 519         data = bswap32(data) >> 8;
 520         vga_ioport_write(&s->vga, VGA_PEL_D, data & 0xff);
 521         data >>= 8;
 522         vga_ioport_write(&s->vga, VGA_PEL_D, data & 0xff);
 523         data >>= 8;
 524         vga_ioport_write(&s->vga, VGA_PEL_D, data & 0xff);
 525         break;
 526     case CRTC_H_TOTAL_DISP:
 527         s->regs.crtc_h_total_disp = data & 0x07ff07ff;
 528         break;
 529     case CRTC_H_SYNC_STRT_WID:
 530         s->regs.crtc_h_sync_strt_wid = data & 0x17bf1fff;
 531         break;
 532     case CRTC_V_TOTAL_DISP:
 533         s->regs.crtc_v_total_disp = data & 0x0fff0fff;
 534         break;
 535     case CRTC_V_SYNC_STRT_WID:
 536         s->regs.crtc_v_sync_strt_wid = data & 0x9f0fff;
 537         break;
 538     case CRTC_OFFSET:
 539         s->regs.crtc_offset = data & 0xc7ffffff;
 540         break;
 541     case CRTC_OFFSET_CNTL:
 542         s->regs.crtc_offset_cntl = data; /* FIXME */
 543         break;
 544     case CRTC_PITCH:
 545         s->regs.crtc_pitch = data & 0x07ff07ff;
 546         break;
 547     case 0xf00 ... 0xfff:
 548         /* read-only copy of PCI config space so ignore writes */
 549         break;
 550     case CUR_OFFSET:
 551         if (s->regs.cur_offset != (data & 0x87fffff0)) {
 552             s->regs.cur_offset = data & 0x87fffff0;
 553             ati_cursor_define(s);
 554         }
 555         break;
 556     case CUR_HORZ_VERT_POSN:
 557         s->regs.cur_hv_pos = data & 0x3fff0fff;
 558         if (data & BIT(31)) {
 559             s->regs.cur_offset |= data & BIT(31);
 560         } else if (s->regs.cur_offset & BIT(31)) {
 561             s->regs.cur_offset &= ~BIT(31);
 562             ati_cursor_define(s);
 563         }
 564         if (!s->cursor_guest_mode &&
 565             (s->regs.crtc_gen_cntl & CRTC2_CUR_EN) && !(data & BIT(31))) {
 566             dpy_mouse_set(s->vga.con, s->regs.cur_hv_pos >> 16,
 567                           s->regs.cur_hv_pos & 0xffff, 1);
 568         }
 569         break;
 570     case CUR_HORZ_VERT_OFF:
 571         s->regs.cur_hv_offs = data & 0x3f003f;
 572         if (data & BIT(31)) {
 573             s->regs.cur_offset |= data & BIT(31);
 574         } else if (s->regs.cur_offset & BIT(31)) {
 575             s->regs.cur_offset &= ~BIT(31);
 576             ati_cursor_define(s);
 577         }
 578         break;
 579     case CUR_CLR0:
 580         if (s->regs.cur_color0 != (data & 0xffffff)) {
 581             s->regs.cur_color0 = data & 0xffffff;
 582             ati_cursor_define(s);
 583         }
 584         break;
 585     case CUR_CLR1:
 586         /*
 587          * Update cursor unconditionally here because some clients set up
 588          * other registers before actually writing cursor data to memory at
 589          * offset so we would miss cursor change unless always updating here
 590          */
 591         s->regs.cur_color1 = data & 0xffffff;
 592         ati_cursor_define(s);
 593         break;
 594     case DST_OFFSET:
 595         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 596             s->regs.dst_offset = data & 0xfffffff0;
 597         } else {
 598             s->regs.dst_offset = data & 0xfffffc00;
 599         }
 600         break;
 601     case DST_PITCH:
 602         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 603             s->regs.dst_pitch = data & 0x3fff;
 604             s->regs.dst_tile = (data >> 16) & 1;
 605         } else {
 606             s->regs.dst_pitch = data & 0x3ff0;
 607         }
 608         break;
 609     case DST_TILE:
 610         if (s->dev_id == PCI_DEVICE_ID_ATI_RADEON_QY) {
 611             s->regs.dst_tile = data & 3;
 612         }
 613         break;
 614     case DST_WIDTH:
 615         s->regs.dst_width = data & 0x3fff;
 616         ati_2d_blt(s);
 617         break;
 618     case DST_HEIGHT:
 619         s->regs.dst_height = data & 0x3fff;
 620         break;
 621     case SRC_X:
 622         s->regs.src_x = data & 0x3fff;
 623         break;
 624     case SRC_Y:
 625         s->regs.src_y = data & 0x3fff;
 626         break;
 627     case DST_X:
 628         s->regs.dst_x = data & 0x3fff;
 629         break;
 630     case DST_Y:
 631         s->regs.dst_y = data & 0x3fff;
 632         break;
 633     case SRC_PITCH_OFFSET:
 634         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 635             s->regs.src_offset = (data & 0x1fffff) << 5;
 636             s->regs.src_pitch = (data >> 21) & 0x3ff;
 637             s->regs.src_tile = data >> 31;
 638         } else {
 639             s->regs.src_offset = (data & 0x3fffff) << 11;
 640             s->regs.src_pitch = (data & 0x3fc00000) >> 16;
 641             s->regs.src_tile = (data >> 30) & 1;
 642         }
 643         break;
 644     case DST_PITCH_OFFSET:
 645         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 646             s->regs.dst_offset = (data & 0x1fffff) << 5;
 647             s->regs.dst_pitch = (data >> 21) & 0x3ff;
 648             s->regs.dst_tile = data >> 31;
 649         } else {
 650             s->regs.dst_offset = (data & 0x3fffff) << 11;
 651             s->regs.dst_pitch = (data & 0x3fc00000) >> 16;
 652             s->regs.dst_tile = data >> 30;
 653         }
 654         break;
 655     case SRC_Y_X:
 656         s->regs.src_x = data & 0x3fff;
 657         s->regs.src_y = (data >> 16) & 0x3fff;
 658         break;
 659     case DST_Y_X:
 660         s->regs.dst_x = data & 0x3fff;
 661         s->regs.dst_y = (data >> 16) & 0x3fff;
 662         break;
 663     case DST_HEIGHT_WIDTH:
 664         s->regs.dst_width = data & 0x3fff;
 665         s->regs.dst_height = (data >> 16) & 0x3fff;
 666         ati_2d_blt(s);
 667         break;
 668     case DP_GUI_MASTER_CNTL:
 669         s->regs.dp_gui_master_cntl = data & 0xf800000f;
 670         s->regs.dp_datatype = (data & 0x0f00) >> 8 | (data & 0x30f0) << 4 |
 671                               (data & 0x4000) << 16;
 672         s->regs.dp_mix = (data & GMC_ROP3_MASK) | (data & 0x7000000) >> 16;
 673         break;
 674     case DST_WIDTH_X:
 675         s->regs.dst_x = data & 0x3fff;
 676         s->regs.dst_width = (data >> 16) & 0x3fff;
 677         ati_2d_blt(s);
 678         break;
 679     case SRC_X_Y:
 680         s->regs.src_y = data & 0x3fff;
 681         s->regs.src_x = (data >> 16) & 0x3fff;
 682         break;
 683     case DST_X_Y:
 684         s->regs.dst_y = data & 0x3fff;
 685         s->regs.dst_x = (data >> 16) & 0x3fff;
 686         break;
 687     case DST_WIDTH_HEIGHT:
 688         s->regs.dst_height = data & 0x3fff;
 689         s->regs.dst_width = (data >> 16) & 0x3fff;
 690         ati_2d_blt(s);
 691         break;
 692     case DST_HEIGHT_Y:
 693         s->regs.dst_y = data & 0x3fff;
 694         s->regs.dst_height = (data >> 16) & 0x3fff;
 695         break;
 696     case SRC_OFFSET:
 697         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 698             s->regs.src_offset = data & 0xfffffff0;
 699         } else {
 700             s->regs.src_offset = data & 0xfffffc00;
 701         }
 702         break;
 703     case SRC_PITCH:
 704         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 705             s->regs.src_pitch = data & 0x3fff;
 706             s->regs.src_tile = (data >> 16) & 1;
 707         } else {
 708             s->regs.src_pitch = data & 0x3ff0;
 709         }
 710         break;
 711     case DP_BRUSH_BKGD_CLR:
 712         s->regs.dp_brush_bkgd_clr = data;
 713         break;
 714     case DP_BRUSH_FRGD_CLR:
 715         s->regs.dp_brush_frgd_clr = data;
 716         break;
 717     case DP_CNTL:
 718         s->regs.dp_cntl = data;
 719         break;
 720     case DP_DATATYPE:
 721         s->regs.dp_datatype = data & 0xe0070f0f;
 722         break;
 723     case DP_MIX:
 724         s->regs.dp_mix = data & 0x00ff0700;
 725         break;
 726     case DP_WRITE_MASK:
 727         s->regs.dp_write_mask = data;
 728         break;
 729     case DEFAULT_OFFSET:
 730         data &= (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF ?
 731                  0x03fffc00 : 0xfffffc00);
 732         s->regs.default_offset = data;
 733         break;
 734     case DEFAULT_PITCH:
 735         if (s->dev_id == PCI_DEVICE_ID_ATI_RAGE128_PF) {
 736             s->regs.default_pitch = data & 0x103ff;
 737         }
 738         break;
 739     case DEFAULT_SC_BOTTOM_RIGHT:
 740         s->regs.default_sc_bottom_right = data & 0x3fff3fff;
 741         break;
 742     default:
 743         break;
 744     }
 745 }
 746
 747 static const MemoryRegionOps ati_mm_ops = {
 748     .read = ati_mm_read,
 749     .write = ati_mm_write,
 750     .endianness = DEVICE_LITTLE_ENDIAN,
 751 };
 752
 753 static void ati_vga_realize(PCIDevice *dev, Error **errp)
 754 {
 755     ATIVGAState *s = ATI_VGA(dev);
 756     VGACommonState *vga = &s->vga;
 757
 758     if (s->model) {
 759         int i;
 760         for (i = 0; i < ARRAY_SIZE(ati_model_aliases); i++) {
 761             if (!strcmp(s->model, ati_model_aliases[i].name)) {
 762                 s->dev_id = ati_model_aliases[i].dev_id;
 763                 break;
 764             }
 765         }
 766         if (i >= ARRAY_SIZE(ati_model_aliases)) {
 767             warn_report("Unknown ATI VGA model name, "
 768                         "using default rage128p");
 769         }
 770     }
 771     if (s->dev_id != PCI_DEVICE_ID_ATI_RAGE128_PF &&
 772         s->dev_id != PCI_DEVICE_ID_ATI_RADEON_QY) {
 773         error_setg(errp, "Unknown ATI VGA device id, "
 774                    "only 0x5046 and 0x5159 are supported");
 775         return;
 776     }
 777     pci_set_word(dev->config + PCI_DEVICE_ID, s->dev_id);
 778
 779     if (s->dev_id == PCI_DEVICE_ID_ATI_RADEON_QY &&
 780         s->vga.vram_size_mb < 16) {
 781         warn_report("Too small video memory for device id");
 782         s->vga.vram_size_mb = 16;
 783     }
 784
 785     /* init vga bits */
 786     vga_common_init(vga, OBJECT(s));
 787     vga_init(vga, OBJECT(s), pci_address_space(dev),
 788              pci_address_space_io(dev), true);
 789     vga->con = graphic_console_init(DEVICE(s), 0, s->vga.hw_ops, &s->vga);
 790     if (s->cursor_guest_mode) {
 791         vga->cursor_invalidate = ati_cursor_invalidate;
 792         vga->cursor_draw_line = ati_cursor_draw_line;
 793     }
 794
 795     /* mmio register space */
 796     memory_region_init_io(&s->mm, OBJECT(s), &ati_mm_ops, s,
 797                           "ati.mmregs", 0x4000);
 798     /* io space is alias to beginning of mmregs */
 799     memory_region_init_alias(&s->io, OBJECT(s), "ati.io", &s->mm, 0, 0x100);
 800
 801     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &vga->vram);
 802     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
 803     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mm);
 804 }
 805
 806 static void ati_vga_reset(DeviceState *dev)
 807 {
 808     ATIVGAState *s = ATI_VGA(dev);
 809
 810     /* reset vga */
 811     vga_common_reset(&s->vga);
 812     s->mode = VGA_MODE;
 813 }
 814
 815 static void ati_vga_exit(PCIDevice *dev)
 816 {
 817     ATIVGAState *s = ATI_VGA(dev);
 818
 819     graphic_console_close(s->vga.con);
 820 }
 821
 822 static Property ati_vga_properties[] = {
 823     DEFINE_PROP_UINT32("vgamem_mb", ATIVGAState, vga.vram_size_mb, 16),
 824     DEFINE_PROP_STRING("model", ATIVGAState, model),
 825     DEFINE_PROP_UINT16("x-device-id", ATIVGAState, dev_id,
 826                        PCI_DEVICE_ID_ATI_RAGE128_PF),
 827     DEFINE_PROP_BOOL("guest_hwcursor", ATIVGAState, cursor_guest_mode, false),
 828     DEFINE_PROP_END_OF_LIST()
 829 };
 830
 831 static void ati_vga_class_init(ObjectClass *klass, void *data)
 832 {
 833     DeviceClass *dc = DEVICE_CLASS(klass);
 834     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 835
 836     dc->reset = ati_vga_reset;
 837     dc->props = ati_vga_properties;
 838     dc->hotpluggable = false;
 839     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 840
 841     k->class_id = PCI_CLASS_DISPLAY_VGA;
 842     k->vendor_id = PCI_VENDOR_ID_ATI;
 843     k->device_id = PCI_DEVICE_ID_ATI_RAGE128_PF;
 844     k->romfile = "vgabios-stdvga.bin";
 845     k->realize = ati_vga_realize;
 846     k->exit = ati_vga_exit;
 847 }
 848
 849 static const TypeInfo ati_vga_info = {
 850     .name = TYPE_ATI_VGA,
 851     .parent = TYPE_PCI_DEVICE,
 852     .instance_size = sizeof(ATIVGAState),
 853     .class_init = ati_vga_class_init,
 854     .interfaces = (InterfaceInfo[]) {
 855           { INTERFACE_CONVENTIONAL_PCI_DEVICE },
 856           { },
 857     },
 858 };
 859
 860 static void ati_vga_register_types(void)
 861 {
 862     type_register_static(&ati_vga_info);
 863 }
 864
 865 type_init(ati_vga_register_types)