]> git.proxmox.com Git - qemu.git/blobdiff - hw/cirrus_vga.c
Don't leak VLANClientState on PCI hot remove
[qemu.git] / hw / cirrus_vga.c
index 59bfdff56b4e7087785a8fedd347d13e7a655764..2ff80d331698986ac26cc38365ecd6b9e569427a 100644 (file)
@@ -31,6 +31,7 @@
 #include "pci.h"
 #include "console.h"
 #include "vga_int.h"
+#include "kvm.h"
 
 /*
  * TODO:
 #define CIRRUS_MMIO_LINEDRAW_MODE     0x39     // byte
 #define CIRRUS_MMIO_BLTSTATUS         0x40     // byte
 
-// PCI 0x00: vendor, 0x02: device
-#define PCI_VENDOR_CIRRUS             0x1013
+// PCI 0x02: device
 #define PCI_DEVICE_CLGD5462           0x00d0
 #define PCI_DEVICE_CLGD5465           0x00d6
 
 #define CIRRUS_HOOK_NOT_HANDLED 0
 #define CIRRUS_HOOK_HANDLED 1
 
+#define ABS(a) ((signed)(a) > 0 ? a : -a)
+
+#define BLTUNSAFE(s) \
+    ( \
+        ( /* check dst is within bounds */ \
+            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
+                + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
+                    (s)->vram_size \
+        ) || \
+        ( /* check src is within bounds */ \
+            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
+                + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
+                    (s)->vram_size \
+        ) \
+    )
+
 struct CirrusVGAState;
 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
                                      uint8_t * dst, const uint8_t * src,
@@ -270,6 +286,8 @@ typedef struct CirrusVGAState {
     int last_hw_cursor_y_end;
     int real_vram_size; /* XXX: suppress that */
     CPUWriteMemoryFunc **cirrus_linear_write;
+    int device_id;
+    int bustype;
 } CirrusVGAState;
 
 typedef struct PCICirrusVGAState {
@@ -639,7 +657,7 @@ static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,
 
     for (y = 0; y < lines; y++) {
        off_cur = off_begin;
-       off_cur_end = off_cur + bytesperline;
+       off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
        off_cur &= TARGET_PAGE_MASK;
        while (off_cur < off_cur_end) {
            cpu_physical_memory_set_dirty(s->vram_offset + off_cur);
@@ -654,7 +672,11 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
 {
     uint8_t *dst;
 
-    dst = s->vram_ptr + s->cirrus_blt_dstaddr;
+    dst = s->vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
+
+    if (BLTUNSAFE(s))
+        return 0;
+
     (*s->cirrus_rop) (s, dst, src,
                       s->cirrus_blt_dstpitch, 0,
                       s->cirrus_blt_width, s->cirrus_blt_height);
@@ -670,8 +692,10 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
 {
     cirrus_fill_t rop_func;
 
+    if (BLTUNSAFE(s))
+        return 0;
     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
-    rop_func(s, s->vram_ptr + s->cirrus_blt_dstaddr,
+    rop_func(s, s->vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
              s->cirrus_blt_dstpitch,
              s->cirrus_blt_width, s->cirrus_blt_height);
     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
@@ -690,8 +714,8 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
 {
     return cirrus_bitblt_common_patterncopy(s,
-                                           s->vram_ptr +
-                                            (s->cirrus_blt_srcaddr & ~7));
+                                           s->vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
+                                            s->cirrus_addr_mask));
 }
 
 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
@@ -706,10 +730,10 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
     s->get_resolution((VGAState *)s, &width, &height);
 
     /* extra x, y */
-    sx = (src % (width * depth)) / depth;
-    sy = (src / (width * depth));
-    dx = (dst % (width *depth)) / depth;
-    dy = (dst / (width * depth));
+    sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
+    sy = (src / ABS(s->cirrus_blt_srcpitch));
+    dx = (dst % ABS(s->cirrus_blt_dstpitch)) / depth;
+    dy = (dst / ABS(s->cirrus_blt_dstpitch));
 
     /* normalize width */
     w /= depth;
@@ -741,42 +765,35 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
     if (notify)
        vga_hw_update();
 
-    (*s->cirrus_rop) (s, s->vram_ptr + s->cirrus_blt_dstaddr,
-                     s->vram_ptr + s->cirrus_blt_srcaddr,
+    (*s->cirrus_rop) (s, s->vram_ptr +
+                     (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
+                     s->vram_ptr +
+                     (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
                      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
                      s->cirrus_blt_width, s->cirrus_blt_height);
 
     if (notify)
-       s->ds->dpy_copy(s->ds,
-                       sx, sy, dx, dy,
-                       s->cirrus_blt_width / depth,
-                       s->cirrus_blt_height);
+       qemu_console_copy(s->ds,
+                         sx, sy, dx, dy,
+                         s->cirrus_blt_width / depth,
+                         s->cirrus_blt_height);
 
     /* we don't have to notify the display that this portion has
-       changed since dpy_copy implies this */
+       changed since qemu_console_copy implies this */
 
-    if (!notify)
-       cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
-                                s->cirrus_blt_dstpitch, s->cirrus_blt_width,
-                                s->cirrus_blt_height);
+    cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
+                               s->cirrus_blt_dstpitch, s->cirrus_blt_width,
+                               s->cirrus_blt_height);
 }
 
 static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
 {
-    if (s->ds->dpy_copy) {
-       cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->start_addr,
-                      s->cirrus_blt_srcaddr - s->start_addr,
-                      s->cirrus_blt_width, s->cirrus_blt_height);
-    } else {
-       (*s->cirrus_rop) (s, s->vram_ptr + s->cirrus_blt_dstaddr,
-                         s->vram_ptr + s->cirrus_blt_srcaddr,
-                         s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
-                         s->cirrus_blt_width, s->cirrus_blt_height);
-
-       cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
-                                s->cirrus_blt_dstpitch, s->cirrus_blt_width,
-                                s->cirrus_blt_height);
-    }
+    if (BLTUNSAFE(s))
+        return 0;
+
+    cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->start_addr,
+            s->cirrus_blt_srcaddr - s->start_addr,
+            s->cirrus_blt_width, s->cirrus_blt_height);
 
     return 1;
 }
@@ -801,8 +818,9 @@ static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
         } else {
             /* at least one scan line */
             do {
-                (*s->cirrus_rop)(s, s->vram_ptr + s->cirrus_blt_dstaddr,
-                                 s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
+                (*s->cirrus_rop)(s, s->vram_ptr +
+                                 (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
+                                  s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
                                          s->cirrus_blt_width, 1);
                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
@@ -830,11 +848,17 @@ static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
 
 static void cirrus_bitblt_reset(CirrusVGAState * s)
 {
+    int need_update;
+
     s->gr[0x31] &=
        ~(CIRRUS_BLT_START | CIRRUS_BLT_BUSY | CIRRUS_BLT_FIFOUSED);
+    need_update = s->cirrus_srcptr != &s->cirrus_bltbuf[0]
+        || s->cirrus_srcptr_end != &s->cirrus_bltbuf[0];
     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
     s->cirrus_srccounter = 0;
+    if (!need_update)
+        return;
     cirrus_update_memory_access(s);
 }
 
@@ -1200,6 +1224,12 @@ static void cirrus_update_bank_ptr(CirrusVGAState * s, unsigned bank_index)
     }
 
     if (limit > 0) {
+        /* Thinking about changing bank base? First, drop the dirty bitmap information
+         * on the current location, otherwise we lose this pointer forever */
+        if (s->lfb_vram_mapped) {
+            target_phys_addr_t base_addr = isa_mem_base + 0xa0000 + bank_index * 0x8000;
+            cpu_physical_sync_dirty_bitmap(base_addr, base_addr + 0x8000);
+        }
        s->cirrus_bank_base[bank_index] = offset;
        s->cirrus_bank_limit[bank_index] = limit;
     } else {
@@ -1328,6 +1358,7 @@ cirrus_hook_write_sr(CirrusVGAState * s, unsigned reg_index, int reg_value)
        s->hw_cursor_y = (reg_value << 3) | (reg_index >> 5);
        break;
     case 0x07:                 // Extended Sequencer Mode
+    cirrus_update_memory_access(s);
     case 0x08:                 // EEPROM Control
     case 0x09:                 // Scratch Register 0
     case 0x0a:                 // Scratch Register 1
@@ -1500,6 +1531,7 @@ cirrus_hook_write_gr(CirrusVGAState * s, unsigned reg_index, int reg_value)
        s->gr[reg_index] = reg_value;
        cirrus_update_bank_ptr(s, 0);
        cirrus_update_bank_ptr(s, 1);
+        cirrus_update_memory_access(s);
         break;
     case 0x0B:
        s->gr[reg_index] = reg_value;
@@ -1597,13 +1629,15 @@ cirrus_hook_read_cr(CirrusVGAState * s, unsigned reg_index, int *reg_value)
     case 0x17:                 // Standard VGA
     case 0x18:                 // Standard VGA
        return CIRRUS_HOOK_NOT_HANDLED;
+    case 0x24:                 // Attribute Controller Toggle Readback (R)
+        *reg_value = (s->ar_flip_flop << 7);
+        break;
     case 0x19:                 // Interlace End
     case 0x1a:                 // Miscellaneous Control
     case 0x1b:                 // Extended Display Control
     case 0x1c:                 // Sync Adjust and Genlock
     case 0x1d:                 // Overlay Extended Control
     case 0x22:                 // Graphics Data Latches Readback (R)
-    case 0x24:                 // Attribute Controller Toggle Readback (R)
     case 0x25:                 // Part Status
     case 0x27:                 // Part ID (R)
        *reg_value = s->cr[reg_index];
@@ -1920,7 +1954,7 @@ static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
     unsigned val = mem_value;
     uint8_t *dst;
 
-    dst = s->vram_ptr + offset;
+    dst = s->vram_ptr + (offset &= s->cirrus_addr_mask);
     for (x = 0; x < 8; x++) {
        if (val & 0x80) {
            *dst = s->cirrus_shadow_gr1;
@@ -1943,7 +1977,7 @@ static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
     unsigned val = mem_value;
     uint8_t *dst;
 
-    dst = s->vram_ptr + offset;
+    dst = s->vram_ptr + (offset &= s->cirrus_addr_mask);
     for (x = 0; x < 8; x++) {
        if (val & 0x80) {
            *dst = s->cirrus_shadow_gr1;
@@ -2291,9 +2325,9 @@ static void cirrus_cursor_draw_line(VGAState *s1, uint8_t *d1, int scr_y)
     color1 = s->rgb_to_pixel(c6_to_8(palette[0xf * 3]),
                              c6_to_8(palette[0xf * 3 + 1]),
                              c6_to_8(palette[0xf * 3 + 2]));
-    bpp = ((s->ds->depth + 7) >> 3);
+    bpp = ((ds_get_bits_per_pixel(s->ds) + 7) >> 3);
     d1 += x1 * bpp;
-    switch(s->ds->depth) {
+    switch(ds_get_bits_per_pixel(s->ds)) {
     default:
         break;
     case 8:
@@ -2588,6 +2622,59 @@ static CPUWriteMemoryFunc *cirrus_linear_bitblt_write[3] = {
     cirrus_linear_bitblt_writel,
 };
 
+static void map_linear_vram(CirrusVGAState *s)
+{
+    vga_dirty_log_stop((VGAState *)s);
+
+    if (!s->map_addr && s->lfb_addr && s->lfb_end) {
+        s->map_addr = s->lfb_addr;
+        s->map_end = s->lfb_end;
+        cpu_register_physical_memory(s->map_addr, s->map_end - s->map_addr, s->vram_offset);
+    }
+
+    if (!s->map_addr)
+        return;
+
+    s->lfb_vram_mapped = 0;
+
+    cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x8000,
+                                (s->vram_offset + s->cirrus_bank_base[0]) | IO_MEM_UNASSIGNED);
+    cpu_register_physical_memory(isa_mem_base + 0xa8000, 0x8000,
+                                (s->vram_offset + s->cirrus_bank_base[1]) | IO_MEM_UNASSIGNED);
+    if (!(s->cirrus_srcptr != s->cirrus_srcptr_end)
+        && !((s->sr[0x07] & 0x01) == 0)
+        && !((s->gr[0x0B] & 0x14) == 0x14)
+        && !(s->gr[0x0B] & 0x02)) {
+
+        vga_dirty_log_stop((VGAState *)s);
+        cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x8000,
+                                    (s->vram_offset + s->cirrus_bank_base[0]) | IO_MEM_RAM);
+        cpu_register_physical_memory(isa_mem_base + 0xa8000, 0x8000,
+                                    (s->vram_offset + s->cirrus_bank_base[1]) | IO_MEM_RAM);
+
+        s->lfb_vram_mapped = 1;
+    }
+    else {
+        cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
+                                     s->vga_io_memory);
+    }
+
+    vga_dirty_log_start((VGAState *)s);
+}
+
+static void unmap_linear_vram(CirrusVGAState *s)
+{
+    vga_dirty_log_stop((VGAState *)s);
+
+    if (s->map_addr && s->lfb_addr && s->lfb_end)
+        s->map_addr = s->map_end = 0;
+
+    cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
+                                 s->vga_io_memory);
+
+    vga_dirty_log_start((VGAState *)s);
+}
+
 /* Compute the memory access functions */
 static void cirrus_update_memory_access(CirrusVGAState *s)
 {
@@ -2606,11 +2693,13 @@ static void cirrus_update_memory_access(CirrusVGAState *s)
 
        mode = s->gr[0x05] & 0x7;
        if (mode < 4 || mode > 5 || ((s->gr[0x0B] & 0x4) == 0)) {
+            map_linear_vram(s);
             s->cirrus_linear_write[0] = cirrus_linear_mem_writeb;
             s->cirrus_linear_write[1] = cirrus_linear_mem_writew;
             s->cirrus_linear_write[2] = cirrus_linear_mem_writel;
         } else {
         generic_io:
+            unmap_linear_vram(s);
             s->cirrus_linear_write[0] = cirrus_linear_writeb;
             s->cirrus_linear_write[1] = cirrus_linear_writew;
             s->cirrus_linear_write[2] = cirrus_linear_writel;
@@ -2713,8 +2802,7 @@ static uint32_t vga_ioport_read(void *opaque, uint32_t addr)
        case 0x3ba:
        case 0x3da:
            /* just toggle to fool polling */
-           s->st01 ^= ST01_V_RETRACE | ST01_DISP_ENABLE;
-           val = s->st01;
+           val = s->st01 = s->retrace((VGAState *) s);
            s->ar_flip_flop = 0;
            break;
        default:
@@ -2777,6 +2865,7 @@ static void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
        break;
     case 0x3c2:
        s->msr = val & ~0x10;
+       s->update_retrace_info((VGAState *) s);
        break;
     case 0x3c4:
        s->sr_index = val;
@@ -2788,6 +2877,7 @@ static void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
        printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
 #endif
        s->sr[s->sr_index] = val & sr_mask[s->sr_index];
+       if (s->sr_index == 1) s->update_retrace_info((VGAState *) s);
        break;
     case 0x3c6:
        cirrus_write_hidden_dac(s, val);
@@ -2855,6 +2945,18 @@ static void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
            s->cr[s->cr_index] = val;
            break;
        }
+
+       switch(s->cr_index) {
+       case 0x00:
+       case 0x04:
+       case 0x05:
+       case 0x06:
+       case 0x07:
+       case 0x11:
+       case 0x17:
+           s->update_retrace_info((VGAState *) s);
+           break;
+       }
        break;
     case 0x3ba:
     case 0x3da:
@@ -3059,6 +3161,7 @@ static int cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_be32s(f, &s->hw_cursor_x);
     qemu_get_be32s(f, &s->hw_cursor_y);
 
+    cirrus_update_memory_access(s);
     /* force refresh */
     s->graphic_mode = -1;
     cirrus_update_bank_ptr(s, 0);
@@ -3072,9 +3175,39 @@ static int cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
  *
  ***************************************/
 
+static void cirrus_reset(void *opaque)
+{
+    CirrusVGAState *s = opaque;
+
+    vga_reset(s);
+    unmap_linear_vram(s);
+    s->sr[0x06] = 0x0f;
+    if (s->device_id == CIRRUS_ID_CLGD5446) {
+        /* 4MB 64 bit memory config, always PCI */
+        s->sr[0x1F] = 0x2d;            // MemClock
+        s->gr[0x18] = 0x0f;             // fastest memory configuration
+        s->sr[0x0f] = 0x98;
+        s->sr[0x17] = 0x20;
+        s->sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
+    } else {
+        s->sr[0x1F] = 0x22;            // MemClock
+        s->sr[0x0F] = CIRRUS_MEMSIZE_2M;
+        s->sr[0x17] = s->bustype;
+        s->sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
+    }
+    s->cr[0x27] = s->device_id;
+
+    /* Win2K seems to assume that the pattern buffer is at 0xff
+       initially ! */
+    memset(s->vram_ptr, 0xff, s->real_vram_size);
+
+    s->cirrus_hidden_dac_lockindex = 5;
+    s->cirrus_hidden_dac_data = 0;
+}
+
 static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
 {
-    int vga_io_memory, i;
+    int i;
     static int inited;
 
     if (!inited) {
@@ -3097,6 +3230,11 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
         rop_to_index[CIRRUS_ROP_NOTSRC] = 13;
         rop_to_index[CIRRUS_ROP_NOTSRC_OR_DST] = 14;
         rop_to_index[CIRRUS_ROP_NOTSRC_AND_NOTDST] = 15;
+        s->device_id = device_id;
+        if (is_pci)
+            s->bustype = CIRRUS_BUSTYPE_PCI;
+        else
+            s->bustype = CIRRUS_BUSTYPE_ISA;
     }
 
     register_ioport_write(0x3c0, 16, 1, vga_ioport_write, s);
@@ -3113,60 +3251,28 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
     register_ioport_read(0x3ba, 1, 1, vga_ioport_read, s);
     register_ioport_read(0x3da, 1, 1, vga_ioport_read, s);
 
-    vga_io_memory = cpu_register_io_memory(0, cirrus_vga_mem_read,
+    s->vga_io_memory = cpu_register_io_memory(0, cirrus_vga_mem_read,
                                            cirrus_vga_mem_write, s);
     cpu_register_physical_memory(isa_mem_base + 0x000a0000, 0x20000,
-                                 vga_io_memory);
-
-    s->sr[0x06] = 0x0f;
-    if (device_id == CIRRUS_ID_CLGD5446) {
-        /* 4MB 64 bit memory config, always PCI */
-        s->sr[0x1F] = 0x2d;            // MemClock
-        s->gr[0x18] = 0x0f;             // fastest memory configuration
-#if 1
-        s->sr[0x0f] = 0x98;
-        s->sr[0x17] = 0x20;
-        s->sr[0x15] = 0x04; /* memory size, 3=2MB, 4=4MB */
-        s->real_vram_size = 4096 * 1024;
-#else
-        s->sr[0x0f] = 0x18;
-        s->sr[0x17] = 0x20;
-        s->sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
-        s->real_vram_size = 2048 * 1024;
-#endif
-    } else {
-        s->sr[0x1F] = 0x22;            // MemClock
-        s->sr[0x0F] = CIRRUS_MEMSIZE_2M;
-        if (is_pci)
-            s->sr[0x17] = CIRRUS_BUSTYPE_PCI;
-        else
-            s->sr[0x17] = CIRRUS_BUSTYPE_ISA;
-        s->real_vram_size = 2048 * 1024;
-        s->sr[0x15] = 0x03; /* memory size, 3=2MB, 4=4MB */
-    }
-    s->cr[0x27] = device_id;
-
-    /* Win2K seems to assume that the pattern buffer is at 0xff
-       initially ! */
-    memset(s->vram_ptr, 0xff, s->real_vram_size);
-
-    s->cirrus_hidden_dac_lockindex = 5;
-    s->cirrus_hidden_dac_data = 0;
+                                 s->vga_io_memory);
+    qemu_register_coalesced_mmio(isa_mem_base + 0x000a0000, 0x20000);
 
     /* I/O handler for LFB */
     s->cirrus_linear_io_addr =
-       cpu_register_io_memory(0, cirrus_linear_read, cirrus_linear_write,
-                              s);
+        cpu_register_io_memory(0, cirrus_linear_read, cirrus_linear_write, s);
     s->cirrus_linear_write = cpu_get_io_memory_write(s->cirrus_linear_io_addr);
 
     /* I/O handler for LFB */
     s->cirrus_linear_bitblt_io_addr =
-       cpu_register_io_memory(0, cirrus_linear_bitblt_read, cirrus_linear_bitblt_write,
-                              s);
+        cpu_register_io_memory(0, cirrus_linear_bitblt_read,
+                               cirrus_linear_bitblt_write, s);
 
     /* I/O handler for memory-mapped I/O */
     s->cirrus_mmio_io_addr =
-       cpu_register_io_memory(0, cirrus_mmio_read, cirrus_mmio_write, s);
+        cpu_register_io_memory(0, cirrus_mmio_read, cirrus_mmio_write, s);
+
+    s->real_vram_size =
+        (s->device_id == CIRRUS_ID_CLGD5446) ? 4096 * 1024 : 2048 * 1024;
 
     /* XXX: s->vram_size must be a power of two */
     s->cirrus_addr_mask = s->real_vram_size - 1;
@@ -3178,6 +3284,8 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
     s->cursor_invalidate = cirrus_cursor_invalidate;
     s->cursor_draw_line = cirrus_cursor_draw_line;
 
+    qemu_register_reset(cirrus_reset, s);
+    cirrus_reset(s);
     register_savevm("cirrus_vga", 0, 2, cirrus_vga_save, cirrus_vga_load, s);
 }
 
@@ -3187,16 +3295,18 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci)
  *
  ***************************************/
 
-void isa_cirrus_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
-                         unsigned long vga_ram_offset, int vga_ram_size)
+void isa_cirrus_vga_init(uint8_t *vga_ram_base,
+                         ram_addr_t vga_ram_offset, int vga_ram_size)
 {
     CirrusVGAState *s;
 
     s = qemu_mallocz(sizeof(CirrusVGAState));
 
     vga_common_init((VGAState *)s,
-                    ds, vga_ram_base, vga_ram_offset, vga_ram_size);
+                    vga_ram_base, vga_ram_offset, vga_ram_size);
     cirrus_init_common(s, CIRRUS_ID_CLGD5430, 0);
+    s->ds = graphic_console_init(s->update, s->invalidate,
+                                 s->screen_dump, s->text_update, s);
     /* XXX ISA-LFB support */
 }
 
@@ -3211,11 +3321,22 @@ static void cirrus_pci_lfb_map(PCIDevice *d, int region_num,
 {
     CirrusVGAState *s = &((PCICirrusVGAState *)d)->cirrus_vga;
 
+    vga_dirty_log_stop((VGAState *)s);
+
     /* XXX: add byte swapping apertures */
     cpu_register_physical_memory(addr, s->vram_size,
                                 s->cirrus_linear_io_addr);
     cpu_register_physical_memory(addr + 0x1000000, 0x400000,
                                 s->cirrus_linear_bitblt_io_addr);
+
+    s->map_addr = s->map_end = 0;
+    s->lfb_addr = addr & TARGET_PAGE_MASK;
+    s->lfb_end = ((addr + VGA_RAM_SIZE) + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
+    /* account for overflow */
+    if (s->lfb_end < addr + VGA_RAM_SIZE)
+        s->lfb_end = addr + VGA_RAM_SIZE;
+
+    vga_dirty_log_start((VGAState *)s);
 }
 
 static void cirrus_pci_mmio_map(PCIDevice *d, int region_num,
@@ -3227,8 +3348,24 @@ static void cirrus_pci_mmio_map(PCIDevice *d, int region_num,
                                 s->cirrus_mmio_io_addr);
 }
 
-void pci_cirrus_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
-                         unsigned long vga_ram_offset, int vga_ram_size)
+static void pci_cirrus_write_config(PCIDevice *d,
+                                    uint32_t address, uint32_t val, int len)
+{
+    PCICirrusVGAState *pvs = container_of(d, PCICirrusVGAState, dev);
+    CirrusVGAState *s = &pvs->cirrus_vga;
+
+    vga_dirty_log_stop((VGAState *)s);
+
+    pci_default_write_config(d, address, val, len);
+    if (s->map_addr && pvs->dev.io_regions[0].addr == -1)
+        s->map_addr = 0;
+    cirrus_update_memory_access(s);
+
+    vga_dirty_log_start((VGAState *)s);
+}
+
+void pci_cirrus_vga_init(PCIBus *bus, uint8_t *vga_ram_base,
+                         ram_addr_t vga_ram_offset, int vga_ram_size)
 {
     PCICirrusVGAState *d;
     uint8_t *pci_conf;
@@ -3240,24 +3377,22 @@ void pci_cirrus_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
     /* setup PCI configuration registers */
     d = (PCICirrusVGAState *)pci_register_device(bus, "Cirrus VGA",
                                                  sizeof(PCICirrusVGAState),
-                                                 -1, NULL, NULL);
+                                                 -1, NULL, pci_cirrus_write_config);
     pci_conf = d->dev.config;
-    pci_conf[0x00] = (uint8_t) (PCI_VENDOR_CIRRUS & 0xff);
-    pci_conf[0x01] = (uint8_t) (PCI_VENDOR_CIRRUS >> 8);
-    pci_conf[0x02] = (uint8_t) (device_id & 0xff);
-    pci_conf[0x03] = (uint8_t) (device_id >> 8);
+    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_CIRRUS);
+    pci_config_set_device_id(pci_conf, device_id);
     pci_conf[0x04] = PCI_COMMAND_IOACCESS | PCI_COMMAND_MEMACCESS;
-    pci_conf[0x0a] = PCI_CLASS_SUB_VGA;
-    pci_conf[0x0b] = PCI_CLASS_BASE_DISPLAY;
+    pci_config_set_class(pci_conf, PCI_CLASS_DISPLAY_VGA);
     pci_conf[0x0e] = PCI_CLASS_HEADERTYPE_00h;
 
     /* setup VGA */
     s = &d->cirrus_vga;
     vga_common_init((VGAState *)s,
-                    ds, vga_ram_base, vga_ram_offset, vga_ram_size);
+                    vga_ram_base, vga_ram_offset, vga_ram_size);
     cirrus_init_common(s, device_id, 1);
 
-    graphic_console_init(s->ds, s->update, s->invalidate, s->screen_dump, s);
+    s->ds = graphic_console_init(s->update, s->invalidate,
+                                 s->screen_dump, s->text_update, s);
 
     s->pci_dev = (PCIDevice *)d;