refuse write accesses in BIOS area (aka EMM386.EXE fix) (Mike Nordell)
[qemu] / hw / vga.c
index 97270bf..ce1754f 100644 (file)
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -1,5 +1,5 @@
 /*
- * QEMU VGA Emulator. An S3 86c968 is emulated
+ * QEMU VGA Emulator.
  * 
  * Copyright (c) 2003 Fabrice Bellard
  * 
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <getopt.h>
-#include <inttypes.h>
-#include <unistd.h>
-#include <sys/mman.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <time.h>
-#include <sys/time.h>
-#include <malloc.h>
-#include <termios.h>
-#include <sys/poll.h>
-#include <errno.h>
-#include <sys/wait.h>
-#include <netinet/in.h>
-
-#include "cpu-i386.h"
-#include "exec.h"
-
 #include "vl.h"
 
-#define NO_THUNK_TYPE_SIZE
-#include "thunk.h"
-
 //#define DEBUG_VGA
+//#define DEBUG_VGA_MEM
+//#define DEBUG_VGA_REG
+
+//#define DEBUG_S3
+//#define DEBUG_BOCHS_VBE
+
+#define CONFIG_S3VGA
 
 #define MSR_COLOR_EMULATION 0x01
 #define MSR_PAGE_SELECT     0x20
 #define ST01_V_RETRACE      0x08
 #define ST01_DISP_ENABLE    0x01
 
+/* bochs VBE support */
+#define CONFIG_BOCHS_VBE
+
+#define VBE_DISPI_MAX_XRES              1024
+#define VBE_DISPI_MAX_YRES              768
+
+#define VBE_DISPI_INDEX_ID              0x0
+#define VBE_DISPI_INDEX_XRES            0x1
+#define VBE_DISPI_INDEX_YRES            0x2
+#define VBE_DISPI_INDEX_BPP             0x3
+#define VBE_DISPI_INDEX_ENABLE          0x4
+#define VBE_DISPI_INDEX_BANK            0x5
+#define VBE_DISPI_INDEX_VIRT_WIDTH      0x6
+#define VBE_DISPI_INDEX_VIRT_HEIGHT     0x7
+#define VBE_DISPI_INDEX_X_OFFSET        0x8
+#define VBE_DISPI_INDEX_Y_OFFSET        0x9
+#define VBE_DISPI_INDEX_NB              0xa
+      
+#define VBE_DISPI_ID0                   0xB0C0
+#define VBE_DISPI_ID1                   0xB0C1
+#define VBE_DISPI_ID2                   0xB0C2
+  
+#define VBE_DISPI_DISABLED              0x00
+#define VBE_DISPI_ENABLED               0x01
+#define VBE_DISPI_LFB_ENABLED           0x40
+#define VBE_DISPI_NOCLEARMEM            0x80
+  
+#define VBE_DISPI_LFB_PHYSICAL_ADDRESS  0xE0000000
+
 typedef struct VGAState {
     uint8_t *vram_ptr;
     unsigned long vram_offset;
@@ -80,12 +91,20 @@ typedef struct VGAState {
     uint8_t dac_write_index;
     uint8_t dac_cache[3]; /* used when writing */
     uint8_t palette[768];
-
+    uint32_t bank_offset;
+#ifdef CONFIG_BOCHS_VBE
+    uint16_t vbe_index;
+    uint16_t vbe_regs[VBE_DISPI_INDEX_NB];
+    uint32_t vbe_start_addr;
+    uint32_t vbe_line_offset;
+    uint32_t vbe_bank_mask;
+#endif
     /* display refresh support */
     DisplayState *ds;
     uint32_t font_offsets[2];
     int graphic_mode;
-    int shift_control;
+    uint8_t shift_control;
+    uint8_t double_scan;
     uint32_t line_offset;
     uint32_t line_compare;
     uint32_t start_addr;
@@ -93,10 +112,10 @@ typedef struct VGAState {
     uint32_t last_width, last_height;
     uint8_t cursor_start, cursor_end;
     uint32_t cursor_offset;
+    unsigned int (*rgb_to_pixel)(unsigned int r, unsigned int g, unsigned b);
     /* tell for each page if it has been updated since the last time */
-    uint8_t vram_updated[VGA_RAM_SIZE / 4096];
     uint32_t last_palette[256];
-#define CH_ATTR_SIZE (132 * 60)
+#define CH_ATTR_SIZE (160 * 100)
     uint32_t last_ch_attr[CH_ATTR_SIZE]; /* XXX: make it dynamic */
 } VGAState;
 
@@ -138,12 +157,24 @@ static const uint8_t gr_mask[16] = {
                (((uint32_t)(__x) & (uint32_t)0x00ff0000UL) >>  8) | \
                (((uint32_t)(__x) & (uint32_t)0xff000000UL) >> 24) ))
 
-#ifdef WORD_BIGENDIAN
+#ifdef WORDS_BIGENDIAN
 #define PAT(x) cbswap_32(x)
 #else
 #define PAT(x) (x)
 #endif
 
+#ifdef WORDS_BIGENDIAN
+#define BIG 1
+#else
+#define BIG 0
+#endif
+
+#ifdef WORDS_BIGENDIAN
+#define GET_PLANE(data, p) (((data) >> (24 - (p) * 8)) & 0xff)
+#else
+#define GET_PLANE(data, p) (((data) >> ((p) * 8)) & 0xff)
+#endif
+
 static const uint32_t mask16[16] = {
     PAT(0x00000000),
     PAT(0x000000ff),
@@ -165,7 +196,7 @@ static const uint32_t mask16[16] = {
 
 #undef PAT
 
-#ifdef WORD_BIGENDIAN
+#ifdef WORDS_BIGENDIAN
 #define PAT(x) (x)
 #else
 #define PAT(x) cbswap_32(x)
@@ -199,13 +230,14 @@ static const uint32_t dmask4[4] = {
 
 static uint32_t expand4[256];
 static uint16_t expand2[256];
+static uint8_t expand4to8[16];
 
 VGAState vga_state;
 int vga_io_memory;
 
-static uint32_t vga_ioport_read(CPUX86State *env, uint32_t addr)
+static uint32_t vga_ioport_read(void *opaque, uint32_t addr)
 {
-    VGAState *s = &vga_state;
+    VGAState *s = opaque;
     int val, index;
 
     /* check port range access depending on color/monochrome mode */
@@ -236,6 +268,9 @@ static uint32_t vga_ioport_read(CPUX86State *env, uint32_t addr)
             break;
         case 0x3c5:
             val = s->sr[s->sr_index];
+#ifdef DEBUG_VGA_REG
+            printf("vga: read SR%x = 0x%02x\n", s->sr_index, val);
+#endif
             break;
         case 0x3c7:
             val = s->dac_state;
@@ -258,6 +293,9 @@ static uint32_t vga_ioport_read(CPUX86State *env, uint32_t addr)
             break;
         case 0x3cf:
             val = s->gr[s->gr_index];
+#ifdef DEBUG_VGA_REG
+            printf("vga: read GR%x = 0x%02x\n", s->gr_index, val);
+#endif
             break;
         case 0x3b4:
         case 0x3d4:
@@ -266,6 +304,14 @@ static uint32_t vga_ioport_read(CPUX86State *env, uint32_t addr)
         case 0x3b5:
         case 0x3d5:
             val = s->cr[s->cr_index];
+#ifdef DEBUG_VGA_REG
+            printf("vga: read CR%x = 0x%02x\n", s->cr_index, val);
+#endif
+#ifdef DEBUG_S3
+            if (s->cr_index >= 0x20)
+                printf("S3: CR read index=0x%x val=0x%x\n",
+                       s->cr_index, val);
+#endif
             break;
         case 0x3ba:
         case 0x3da:
@@ -279,15 +325,15 @@ static uint32_t vga_ioport_read(CPUX86State *env, uint32_t addr)
             break;
         }
     }
-#ifdef DEBUG_VGA
+#if defined(DEBUG_VGA)
     printf("VGA: read addr=0x%04x data=0x%02x\n", addr, val);
 #endif
     return val;
 }
 
-static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
+static void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 {
-    VGAState *s = &vga_state;
+    VGAState *s = opaque;
     int index, v;
 
     /* check port range access depending on color/monochrome mode */
@@ -338,6 +384,9 @@ static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
         s->sr_index = val & 7;
         break;
     case 0x3c5:
+#ifdef DEBUG_VGA_REG
+        printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
+#endif
         s->sr[s->sr_index] = val & sr_mask[s->sr_index];
         break;
     case 0x3c7:
@@ -362,6 +411,9 @@ static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
         s->gr_index = val & 0x0f;
         break;
     case 0x3cf:
+#ifdef DEBUG_VGA_REG
+        printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
+#endif
         s->gr[s->gr_index] = val & gr_mask[s->gr_index];
         break;
     case 0x3b4:
@@ -370,6 +422,9 @@ static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
         break;
     case 0x3b5:
     case 0x3d5:
+#ifdef DEBUG_VGA_REG
+        printf("vga: write CR%x = 0x%02x\n", s->cr_index, val);
+#endif
         /* handle CR0-7 protection */
         if ((s->cr[11] & 0x80) && s->cr_index <= 7) {
             /* can always write bit 4 of CR7 */
@@ -387,6 +442,7 @@ static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
             s->cr[s->cr_index] = val;
             break;
 
+#ifdef CONFIG_S3VGA
             /* S3 registers */
         case 0x2d:
         case 0x2e:
@@ -406,10 +462,16 @@ static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
             v = val & 3;
             s->cr[0x69] = (s->cr[69] & ~0x0c) | (v << 2);
             break;
+#endif
         default:
             s->cr[s->cr_index] = val;
             break;
         }
+#ifdef DEBUG_S3
+        if (s->cr_index >= 0x20)
+            printf("S3: CR write index=0x%x val=0x%x\n",
+                   s->cr_index, val);
+#endif
         break;
     case 0x3ba:
     case 0x3da:
@@ -418,6 +480,165 @@ static void vga_ioport_write(CPUX86State *env, uint32_t addr, uint32_t val)
     }
 }
 
+#ifdef CONFIG_BOCHS_VBE
+static uint32_t vbe_ioport_read(void *opaque, uint32_t addr)
+{
+    VGAState *s = opaque;
+    uint32_t val;
+
+    addr &= 1;
+    if (addr == 0) {
+        val = s->vbe_index;
+    } else {
+        if (s->vbe_index <= VBE_DISPI_INDEX_NB)
+            val = s->vbe_regs[s->vbe_index];
+        else
+            val = 0;
+#ifdef DEBUG_BOCHS_VBE
+        printf("VBE: read index=0x%x val=0x%x\n", s->vbe_index, val);
+#endif
+    }
+    return val;
+}
+
+static void vbe_ioport_write(void *opaque, uint32_t addr, uint32_t val)
+{
+    VGAState *s = opaque;
+
+    addr &= 1;
+    if (addr == 0) {
+        s->vbe_index = val;
+    } else if (s->vbe_index <= VBE_DISPI_INDEX_NB) {
+#ifdef DEBUG_BOCHS_VBE
+        printf("VBE: write index=0x%x val=0x%x\n", s->vbe_index, val);
+#endif
+        switch(s->vbe_index) {
+        case VBE_DISPI_INDEX_ID:
+            if (val == VBE_DISPI_ID0 ||
+                val == VBE_DISPI_ID1 ||
+                val == VBE_DISPI_ID2) {
+                s->vbe_regs[s->vbe_index] = val;
+            }
+            break;
+        case VBE_DISPI_INDEX_XRES:
+            if ((val <= VBE_DISPI_MAX_XRES) && ((val & 7) == 0)) {
+                s->vbe_regs[s->vbe_index] = val;
+            }
+            break;
+        case VBE_DISPI_INDEX_YRES:
+            if (val <= VBE_DISPI_MAX_YRES) {
+                s->vbe_regs[s->vbe_index] = val;
+            }
+            break;
+        case VBE_DISPI_INDEX_BPP:
+            if (val == 0)
+                val = 8;
+            if (val == 4 || val == 8 || val == 15 || 
+                val == 16 || val == 24 || val == 32) {
+                s->vbe_regs[s->vbe_index] = val;
+            }
+            break;
+        case VBE_DISPI_INDEX_BANK:
+            val &= s->vbe_bank_mask;
+            s->vbe_regs[s->vbe_index] = val;
+            s->bank_offset = (val << 16) - 0xa0000;
+            break;
+        case VBE_DISPI_INDEX_ENABLE:
+            if (val & VBE_DISPI_ENABLED) {
+                int h, shift_control;
+
+                s->vbe_regs[VBE_DISPI_INDEX_VIRT_WIDTH] = 
+                    s->vbe_regs[VBE_DISPI_INDEX_XRES];
+                s->vbe_regs[VBE_DISPI_INDEX_VIRT_HEIGHT] = 
+                    s->vbe_regs[VBE_DISPI_INDEX_YRES];
+                s->vbe_regs[VBE_DISPI_INDEX_X_OFFSET] = 0;
+                s->vbe_regs[VBE_DISPI_INDEX_Y_OFFSET] = 0;
+                
+                if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4)
+                    s->vbe_line_offset = s->vbe_regs[VBE_DISPI_INDEX_XRES] >> 1;
+                else
+                    s->vbe_line_offset = s->vbe_regs[VBE_DISPI_INDEX_XRES] * 
+                        ((s->vbe_regs[VBE_DISPI_INDEX_BPP] + 7) >> 3);
+                s->vbe_start_addr = 0;
+                
+                /* clear the screen (should be done in BIOS) */
+                if (!(val & VBE_DISPI_NOCLEARMEM)) {
+                    memset(s->vram_ptr, 0, 
+                           s->vbe_regs[VBE_DISPI_INDEX_YRES] * s->vbe_line_offset);
+                }
+                
+                /* we initialize the VGA graphic mode (should be done
+                   in BIOS) */
+                s->gr[0x06] = (s->gr[0x06] & ~0x0c) | 0x05; /* graphic mode + memory map 1 */
+                s->cr[0x17] |= 3; /* no CGA modes */
+                s->cr[0x13] = s->vbe_line_offset >> 3;
+                /* width */
+                s->cr[0x01] = (s->vbe_regs[VBE_DISPI_INDEX_XRES] >> 3) - 1;
+                /* height */
+                h = s->vbe_regs[VBE_DISPI_INDEX_YRES] - 1;
+                s->cr[0x12] = h;
+                s->cr[0x07] = (s->cr[0x07] & ~0x42) | 
+                    ((h >> 7) & 0x02) | ((h >> 3) & 0x40);
+                /* line compare to 1023 */
+                s->cr[0x18] = 0xff;
+                s->cr[0x07] |= 0x10;
+                s->cr[0x09] |= 0x40;
+                
+                if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
+                    shift_control = 0;
+                    s->sr[0x01] &= ~8; /* no double line */
+                } else {
+                    shift_control = 2;
+                }
+                s->gr[0x05] = (s->gr[0x05] & ~0x60) | (shift_control << 5);
+                s->cr[0x09] &= ~0x9f; /* no double scan */
+                s->vbe_regs[s->vbe_index] = val;
+            } else {
+                /* XXX: the bios should do that */
+                s->bank_offset = -0xa0000;
+            }
+            break;
+        case VBE_DISPI_INDEX_VIRT_WIDTH:
+            {
+                int w, h, line_offset;
+
+                if (val < s->vbe_regs[VBE_DISPI_INDEX_XRES])
+                    return;
+                w = val;
+                if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4)
+                    line_offset = w >> 1;
+                else
+                    line_offset = w * ((s->vbe_regs[VBE_DISPI_INDEX_BPP] + 7) >> 3);
+                h = s->vram_size / line_offset;
+                /* XXX: support weird bochs semantics ? */
+                if (h < s->vbe_regs[VBE_DISPI_INDEX_YRES])
+                    return;
+                s->vbe_regs[VBE_DISPI_INDEX_VIRT_WIDTH] = w;
+                s->vbe_regs[VBE_DISPI_INDEX_VIRT_HEIGHT] = h;
+                s->vbe_line_offset = line_offset;
+            }
+            break;
+        case VBE_DISPI_INDEX_X_OFFSET:
+        case VBE_DISPI_INDEX_Y_OFFSET:
+            {
+                int x;
+                s->vbe_regs[s->vbe_index] = val;
+                s->vbe_start_addr = s->vbe_line_offset * s->vbe_regs[VBE_DISPI_INDEX_Y_OFFSET];
+                x = s->vbe_regs[VBE_DISPI_INDEX_X_OFFSET];
+                if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4)
+                    s->vbe_start_addr += x >> 1;
+                else
+                    s->vbe_start_addr += x * ((s->vbe_regs[VBE_DISPI_INDEX_BPP] + 7) >> 3);
+                s->vbe_start_addr >>= 2;
+            }
+            break;
+        default:
+            break;
+        }
+    }
+}
+#endif
+
 /* called for accesses between 0xa0000 and 0xc0000 */
 static uint32_t vga_mem_readb(uint32_t addr)
 {
@@ -432,9 +653,9 @@ static uint32_t vga_mem_readb(uint32_t addr)
         addr -= 0xa0000;
         break;
     case 1:
-        addr -= 0xa0000;
-        if (addr >= 0x10000)
+        if (addr >= 0xb0000)
             return 0xff;
+        addr += s->bank_offset;
         break;
     case 2:
         addr -= 0xb0000;
@@ -444,6 +665,8 @@ static uint32_t vga_mem_readb(uint32_t addr)
     default:
     case 3:
         addr -= 0xb8000;
+        if (addr >= 0x8000)
+            return 0xff;
         break;
     }
     
@@ -461,11 +684,7 @@ static uint32_t vga_mem_readb(uint32_t addr)
         if (!(s->gr[5] & 0x08)) {
             /* read mode 0 */
             plane = s->gr[4];
-#ifdef WORD_BIGENDIAN
-            ret = (s->latch >> (24 - (plane * 8))) & 0xff;
-#else
-            ret = (s->latch >> (plane * 8)) & 0xff;
-#endif
+            ret = GET_PLANE(s->latch, plane);
         } else {
             /* read mode 1 */
             ret = (s->latch ^ mask16[s->gr[2]]) & mask16[s->gr[7]];
@@ -495,15 +714,14 @@ static uint32_t vga_mem_readl(uint32_t addr)
     return v;
 }
 
-
 /* called for accesses between 0xa0000 and 0xc0000 */
-void vga_mem_writeb(uint32_t addr, uint32_t val)
+static void vga_mem_writeb(uint32_t addr, uint32_t val, uint32_t vaddr)
 {
     VGAState *s = &vga_state;
     int memory_map_mode, plane, write_mode, b, func_select;
     uint32_t write_mask, bit_mask, set_mask;
 
-#ifdef DEBUG_VGA
+#ifdef DEBUG_VGA_MEM
     printf("vga: [0x%x] = 0x%02x\n", addr, val);
 #endif
     /* convert to VGA memory offset */
@@ -513,9 +731,9 @@ void vga_mem_writeb(uint32_t addr, uint32_t val)
         addr -= 0xa0000;
         break;
     case 1:
-        addr -= 0xa0000;
-        if (addr >= 0x10000)
+        if (addr >= 0xb0000)
             return;
+        addr += s->bank_offset;
         break;
     case 2:
         addr -= 0xb0000;
@@ -525,6 +743,8 @@ void vga_mem_writeb(uint32_t addr, uint32_t val)
     default:
     case 3:
         addr -= 0xb8000;
+        if (addr >= 0x8000)
+            return;
         break;
     }
     
@@ -533,10 +753,10 @@ void vga_mem_writeb(uint32_t addr, uint32_t val)
         plane = addr & 3;
         if (s->sr[2] & (1 << plane)) {
             s->vram_ptr[addr] = val;
-#ifdef DEBUG_VGA
+#ifdef DEBUG_VGA_MEM
             printf("vga: chain4: [0x%x]\n", addr);
 #endif
-            s->vram_updated[addr >> 12] = 1;
+            cpu_physical_memory_set_dirty(s->vram_offset + addr);
         }
     } else if (s->gr[5] & 0x10) {
         /* odd/even mode (aka text mode mapping) */
@@ -544,10 +764,10 @@ void vga_mem_writeb(uint32_t addr, uint32_t val)
         if (s->sr[2] & (1 << plane)) {
             addr = ((addr & ~1) << 1) | plane;
             s->vram_ptr[addr] = val;
-#ifdef DEBUG_VGA
+#ifdef DEBUG_VGA_MEM
             printf("vga: odd/even: [0x%x]\n", addr);
 #endif
-            s->vram_updated[addr >> 12] = 1;
+            cpu_physical_memory_set_dirty(s->vram_offset + addr);
         }
     } else {
         /* standard VGA latched access */
@@ -576,7 +796,7 @@ void vga_mem_writeb(uint32_t addr, uint32_t val)
         case 3:
             /* rotate */
             b = s->gr[3] & 7;
-            val = ((val >> b) | (val << (8 - b)));
+            val = (val >> b) | (val << (8 - b));
 
             bit_mask = s->gr[8] & val;
             val = mask16[s->gr[0]];
@@ -615,40 +835,28 @@ void vga_mem_writeb(uint32_t addr, uint32_t val)
         ((uint32_t *)s->vram_ptr)[addr] = 
             (((uint32_t *)s->vram_ptr)[addr] & ~write_mask) | 
             (val & write_mask);
-#ifdef DEBUG_VGA
+#ifdef DEBUG_VGA_MEM
             printf("vga: latch: [0x%x] mask=0x%08x val=0x%08x\n", 
                    addr * 4, write_mask, val);
 #endif
-        s->vram_updated[addr >> 10] = 1;
+            cpu_physical_memory_set_dirty(s->vram_offset + (addr << 2));
     }
 }
 
-void vga_mem_writew(uint32_t addr, uint32_t val)
+static void vga_mem_writew(uint32_t addr, uint32_t val, uint32_t vaddr)
 {
-    vga_mem_writeb(addr, val & 0xff);
-    vga_mem_writeb(addr + 1, (val >> 8) & 0xff);
+    vga_mem_writeb(addr, val & 0xff, vaddr);
+    vga_mem_writeb(addr + 1, (val >> 8) & 0xff, vaddr);
 }
 
-void vga_mem_writel(uint32_t addr, uint32_t val)
+static void vga_mem_writel(uint32_t addr, uint32_t val, uint32_t vaddr)
 {
-    vga_mem_writeb(addr, val & 0xff);
-    vga_mem_writeb(addr + 1, (val >> 8) & 0xff);
-    vga_mem_writeb(addr + 2, (val >> 16) & 0xff);
-    vga_mem_writeb(addr + 3, (val >> 24) & 0xff);
+    vga_mem_writeb(addr, val & 0xff, vaddr);
+    vga_mem_writeb(addr + 1, (val >> 8) & 0xff, vaddr);
+    vga_mem_writeb(addr + 2, (val >> 16) & 0xff, vaddr);
+    vga_mem_writeb(addr + 3, (val >> 24) & 0xff, vaddr);
 }
 
-#ifdef WORD_BIGENDIAN
-#define BIG 1
-#else
-#define BIG 0
-#endif
-
-#ifdef WORDS_BIGENDIAN
-#define GET_PLANE(data, p) (((data) >> (24 - (p) * 8)) & 0xff)
-#else
-#define GET_PLANE(data, p) (((data) >> ((p) * 8)) & 0xff)
-#endif
-
 typedef void vga_draw_glyph8_func(uint8_t *d, int linesize,
                              const uint8_t *font_ptr, int h,
                              uint32_t fgcol, uint32_t bgcol);
@@ -699,28 +907,43 @@ static inline int c6_to_8(int v)
     return (v << 2) | (b << 1) | b;
 }
 
+static unsigned int rgb_to_pixel8_dup(unsigned int r, unsigned int g, unsigned b)
+{
+    unsigned int col;
+    col = rgb_to_pixel8(r, g, b);
+    col |= col << 8;
+    col |= col << 16;
+    return col;
+}
+
+static unsigned int rgb_to_pixel15_dup(unsigned int r, unsigned int g, unsigned b)
+{
+    unsigned int col;
+    col = rgb_to_pixel15(r, g, b);
+    col |= col << 16;
+    return col;
+}
+
+static unsigned int rgb_to_pixel16_dup(unsigned int r, unsigned int g, unsigned b)
+{
+    unsigned int col;
+    col = rgb_to_pixel16(r, g, b);
+    col |= col << 16;
+    return col;
+}
+
+static unsigned int rgb_to_pixel32_dup(unsigned int r, unsigned int g, unsigned b)
+{
+    unsigned int col;
+    col = rgb_to_pixel32(r, g, b);
+    return col;
+}
+
 /* return true if the palette was modified */
 static int update_palette16(VGAState *s)
 {
-    int full_update, i, depth;
+    int full_update, i;
     uint32_t v, col, *palette;
-    unsigned int (*rgb_to_pixel)(unsigned int r, unsigned int g, unsigned b);
-    depth = s->ds->depth;
-    switch(depth) {
-    case 8:
-        rgb_to_pixel = rgb_to_pixel8;
-        break;
-    case 15:
-        rgb_to_pixel = rgb_to_pixel15;
-        break;
-    default:
-    case 16:
-        rgb_to_pixel = rgb_to_pixel16;
-        break;
-    case 32:
-        rgb_to_pixel = rgb_to_pixel32;
-        break;
-    }
 
     full_update = 0;
     palette = s->last_palette;
@@ -731,21 +954,35 @@ static int update_palette16(VGAState *s)
         else
             v = ((s->ar[0x14] & 0xc) << 4) | (v & 0x3f);
         v = v * 3;
-        col = rgb_to_pixel(c6_to_8(s->palette[v]), 
-                           c6_to_8(s->palette[v + 1]), 
-                           c6_to_8(s->palette[v + 2]));
-        
-        if (depth == 8) {
-            col |= col << 8;
-            col |= col << 16;
-        } else if (depth <= 16) {
-            col |= col << 16;
+        col = s->rgb_to_pixel(c6_to_8(s->palette[v]), 
+                              c6_to_8(s->palette[v + 1]), 
+                              c6_to_8(s->palette[v + 2]));
+        if (col != palette[i]) {
+            full_update = 1;
+            palette[i] = col;
         }
-        //        printf("%2d: %08x\n", i, col);
+    }
+    return full_update;
+}
+
+/* return true if the palette was modified */
+static int update_palette256(VGAState *s)
+{
+    int full_update, i;
+    uint32_t v, col, *palette;
+
+    full_update = 0;
+    palette = s->last_palette;
+    v = 0;
+    for(i = 0; i < 256; i++) {
+        col = s->rgb_to_pixel(c6_to_8(s->palette[v]), 
+                              c6_to_8(s->palette[v + 1]), 
+                              c6_to_8(s->palette[v + 2]));
         if (col != palette[i]) {
             full_update = 1;
             palette[i] = col;
         }
+        v += 3;
     }
     return full_update;
 }
@@ -757,17 +994,31 @@ static int update_basic_params(VGAState *s)
     uint32_t start_addr, line_offset, line_compare, v;
     
     full_update = 0;
-    /* compute line_offset in bytes */
-    v = (s->cr[0x51] >> 4) & 3; /* S3 extension */
-    if (v == 0)
-        v = (s->cr[0x43] >> 2) & 1; /* S3 extension */
-    line_offset = s->cr[0x13] | (v << 8);
-    line_offset <<= 3;
-
-    /* starting address */
-    start_addr = s->cr[0x0d] | (s->cr[0x0c] << 8);
-    start_addr |= (s->cr[0x69] & 0x1f) << 16; /* S3 extension */
 
+#ifdef CONFIG_BOCHS_VBE
+    if (s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED) {
+        line_offset = s->vbe_line_offset;
+        start_addr = s->vbe_start_addr;
+    } else
+#endif
+    {  
+        /* compute line_offset in bytes */
+        line_offset = s->cr[0x13];
+#ifdef CONFIG_S3VGA
+        v = (s->cr[0x51] >> 4) & 3; /* S3 extension */
+        if (v == 0)
+            v = (s->cr[0x43] >> 2) & 1; /* S3 extension */
+        line_offset |= (v << 8);
+#endif
+        line_offset <<= 3;
+        
+        /* starting address */
+        start_addr = s->cr[0x0d] | (s->cr[0x0c] << 8);
+#ifdef CONFIG_S3VGA
+        start_addr |= (s->cr[0x69] & 0x1f) << 16; /* S3 extension */
+#endif
+    }
+    
     /* line compare */
     line_compare = s->cr[0x18] | 
         ((s->cr[0x07] & 0x10) << 4) |
@@ -806,6 +1057,13 @@ static vga_draw_glyph8_func *vga_draw_glyph8_table[4] = {
     vga_draw_glyph8_32,
 };
 
+static vga_draw_glyph8_func *vga_draw_glyph16_table[4] = {
+    vga_draw_glyph16_8,
+    vga_draw_glyph16_16,
+    vga_draw_glyph16_16,
+    vga_draw_glyph16_32,
+};
+
 static vga_draw_glyph9_func *vga_draw_glyph9_table[4] = {
     vga_draw_glyph9_8,
     vga_draw_glyph9_16,
@@ -882,12 +1140,19 @@ static void vga_draw_text(VGAState *s, int full_update)
     cw = 8;
     if (s->sr[1] & 0x01)
         cw = 9;
+    if (s->sr[1] & 0x08)
+        cw = 16; /* NOTE: no 18 pixel wide */
     x_incr = cw * ((s->ds->depth + 7) >> 3);
     width = (s->cr[0x01] + 1);
-    height = s->cr[0x12] | 
-        ((s->cr[0x07] & 0x02) << 7) | 
-        ((s->cr[0x07] & 0x40) << 3);
-    height = (height + 1) / cheight;
+    if (s->cr[0x06] == 100) {
+        /* ugly hack for CGA 160x100x16 - explain me the logic */
+        height = 100;
+    } else {
+        height = s->cr[0x12] | 
+            ((s->cr[0x07] & 0x02) << 7) | 
+            ((s->cr[0x07] & 0x40) << 3);
+        height = (height + 1) / cheight;
+    }
     if (width != s->last_width || height != s->last_height ||
         cw != s->last_cw || cw != s->last_cw) {
         dpy_resize(s->ds, width * cw, height * cheight);
@@ -914,7 +1179,10 @@ static void vga_draw_text(VGAState *s, int full_update)
     cursor_ptr = s->vram_ptr + (s->start_addr + cursor_offset) * 4;
     
     depth_index = get_depth_index(s->ds->depth);
-    vga_draw_glyph8 = vga_draw_glyph8_table[depth_index];
+    if (cw == 16)
+        vga_draw_glyph8 = vga_draw_glyph16_table[depth_index];
+    else
+        vga_draw_glyph8 = vga_draw_glyph8_table[depth_index];
     vga_draw_glyph9 = vga_draw_glyph9_table[depth_index];
     
     dest = s->ds->data;
@@ -944,7 +1212,7 @@ static void vga_draw_text(VGAState *s, int full_update)
                 font_ptr += 32 * 4 * ch;
                 bgcol = palette[cattr >> 4];
                 fgcol = palette[cattr & 0x0f];
-                if (cw == 8) {
+                if (cw != 9) {
                     vga_draw_glyph8(d1, linesize, 
                                     font_ptr, cheight, fgcol, bgcol);
                 } else {
@@ -966,7 +1234,7 @@ static void vga_draw_text(VGAState *s, int full_update)
                     if (line_last >= line_start && line_start < cheight) {
                         h = line_last - line_start + 1;
                         d = d1 + linesize * line_start;
-                        if (cw == 8) {
+                        if (cw != 9) {
                             vga_draw_glyph8(d, linesize, 
                                             cursor_glyph, h, fgcol, bgcol);
                         } else {
@@ -989,17 +1257,46 @@ static void vga_draw_text(VGAState *s, int full_update)
     }
 }
 
-static vga_draw_line_func *vga_draw_line_table[4 * 6] = {
+enum {
+    VGA_DRAW_LINE2,
+    VGA_DRAW_LINE2D2,
+    VGA_DRAW_LINE4,
+    VGA_DRAW_LINE4D2,
+    VGA_DRAW_LINE8D2,
+    VGA_DRAW_LINE8,
+    VGA_DRAW_LINE15,
+    VGA_DRAW_LINE16,
+    VGA_DRAW_LINE24,
+    VGA_DRAW_LINE32,
+    VGA_DRAW_LINE_NB,
+};
+
+static vga_draw_line_func *vga_draw_line_table[4 * VGA_DRAW_LINE_NB] = {
     vga_draw_line2_8,
     vga_draw_line2_16,
     vga_draw_line2_16,
     vga_draw_line2_32,
 
+    vga_draw_line2d2_8,
+    vga_draw_line2d2_16,
+    vga_draw_line2d2_16,
+    vga_draw_line2d2_32,
+
     vga_draw_line4_8,
     vga_draw_line4_16,
     vga_draw_line4_16,
     vga_draw_line4_32,
 
+    vga_draw_line4d2_8,
+    vga_draw_line4d2_16,
+    vga_draw_line4d2_16,
+    vga_draw_line4d2_32,
+
+    vga_draw_line8d2_8,
+    vga_draw_line8d2_16,
+    vga_draw_line8d2_16,
+    vga_draw_line8d2_32,
+
     vga_draw_line8_8,
     vga_draw_line8_16,
     vga_draw_line8_16,
@@ -1015,6 +1312,11 @@ static vga_draw_line_func *vga_draw_line_table[4 * 6] = {
     vga_draw_line16_16,
     vga_draw_line16_32,
 
+    vga_draw_line24_8,
+    vga_draw_line24_15,
+    vga_draw_line24_16,
+    vga_draw_line24_32,
+
     vga_draw_line32_8,
     vga_draw_line32_15,
     vga_draw_line32_16,
@@ -1029,14 +1331,13 @@ static vga_draw_line_func *vga_draw_line_table[4 * 6] = {
  */
 static void vga_draw_graphic(VGAState *s, int full_update)
 {
-    int y, update, page_min, page_max, linesize, y_start;
+    int y1, y, update, page_min, page_max, linesize, y_start, double_scan, mask;
     int width, height, shift_control, line_offset, page0, page1, bwidth;
+    int disp_width, multi_scan, multi_run;
     uint8_t *d;
     uint32_t v, addr1, addr;
     vga_draw_line_func *vga_draw_line;
-
-    full_update |= update_palette16(s);
-
+    
     full_update |= update_basic_params(s);
 
     width = (s->cr[0x01] + 1) * 8;
@@ -1044,30 +1345,83 @@ static void vga_draw_graphic(VGAState *s, int full_update)
         ((s->cr[0x07] & 0x02) << 7) | 
         ((s->cr[0x07] & 0x40) << 3);
     height = (height + 1);
-
-    if (width != s->last_width ||
-        height != s->last_height) {
-        dpy_resize(s->ds, width, height);
-        s->last_width = width;
-        s->last_height = height;
-        full_update = 1;
-    }
-
+    disp_width = width;
+    
     shift_control = (s->gr[0x05] >> 5) & 3;
-    if (shift_control != s->shift_control) {
+    double_scan = (s->cr[0x09] & 0x80);
+    if (shift_control > 1) {
+        multi_scan = (s->cr[0x09] & 0x1f);
+    } else {
+        multi_scan = 0;
+    }
+    multi_run = multi_scan;
+    if (shift_control != s->shift_control ||
+        double_scan != s->double_scan) {
         full_update = 1;
         s->shift_control = shift_control;
+        s->double_scan = double_scan;
     }
     
-    if (shift_control == 0)
-        v = 1; /* 4 bit/pixel */
-    else if (shift_control == 1)
-        v = 0; /* 2 bit/pixel */
-    else
-        v = 2; /* 8 bit/pixel */
+    if (shift_control == 0) {
+        full_update |= update_palette16(s);
+        if (s->sr[0x01] & 8) {
+            v = VGA_DRAW_LINE4D2;
+            disp_width <<= 1;
+        } else {
+            v = VGA_DRAW_LINE4;
+        }
+    } else if (shift_control == 1) {
+        full_update |= update_palette16(s);
+        if (s->sr[0x01] & 8) {
+            v = VGA_DRAW_LINE2D2;
+            disp_width <<= 1;
+        } else {
+            v = VGA_DRAW_LINE2;
+        }
+    } else {
+#ifdef CONFIG_BOCHS_VBE
+        if (s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED) {
+            switch(s->vbe_regs[VBE_DISPI_INDEX_BPP]) {
+            default:
+            case 8:
+                full_update |= update_palette256(s);
+                v = VGA_DRAW_LINE8;
+                break;
+            case 15:
+                v = VGA_DRAW_LINE15;
+                break;
+            case 16:
+                v = VGA_DRAW_LINE16;
+                break;
+            case 24:
+                v = VGA_DRAW_LINE24;
+                break;
+            case 32:
+                v = VGA_DRAW_LINE32;
+                break;
+            }
+        } else 
+#endif
+        {
+            full_update |= update_palette256(s);
+            v = VGA_DRAW_LINE8D2;
+        }
+    }
     vga_draw_line = vga_draw_line_table[v * 4 + get_depth_index(s->ds->depth)];
-    
+
+    if (disp_width != s->last_width ||
+        height != s->last_height) {
+        dpy_resize(s->ds, disp_width, height);
+        s->last_width = disp_width;
+        s->last_height = height;
+        full_update = 1;
+    }
+
     line_offset = s->line_offset;
+#if 0
+    printf("w=%d h=%d v=%d line_offset=%d double_scan=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=%02x\n",
+           width, height, v, line_offset, s->cr[9], s->cr[0x17], s->line_compare, s->sr[0x01]);
+#endif
     addr1 = (s->start_addr * 4);
     bwidth = width * 4;
     y_start = -1;
@@ -1075,21 +1429,25 @@ static void vga_draw_graphic(VGAState *s, int full_update)
     page_max = -1;
     d = s->ds->data;
     linesize = s->ds->linesize;
+    y1 = 0;
     for(y = 0; y < height; y++) {
         addr = addr1;
         if (!(s->cr[0x17] & 1)) {
+            int shift;
             /* CGA compatibility handling */
-            addr = (addr & ~0x2000) | ((y & 1) << 13);
+            shift = 14 + ((s->cr[0x17] >> 6) & 1);
+            addr = (addr & ~(1 << shift)) | ((y1 & 1) << shift);
         }
         if (!(s->cr[0x17] & 2)) {
-            addr = (addr & ~0x4000) | ((y & 2) << 13);
+            addr = (addr & ~0x8000) | ((y1 & 2) << 14);
         }
-        page0 = addr >> 12;
-        page1 = (addr + bwidth - 1) >> 12;
-        update = full_update | s->vram_updated[page0] | s->vram_updated[page1];
-        if ((page1 - page0) > 1) {
+        page0 = s->vram_offset + (addr & TARGET_PAGE_MASK);
+        page1 = s->vram_offset + ((addr + bwidth - 1) & TARGET_PAGE_MASK);
+        update = full_update | cpu_physical_memory_is_dirty(page0) |
+            cpu_physical_memory_is_dirty(page1);
+        if ((page1 - page0) > TARGET_PAGE_SIZE) {
             /* if wide line, can use another page */
-            update |= s->vram_updated[page0 + 1];
+            update |= cpu_physical_memory_is_dirty(page0 + TARGET_PAGE_SIZE);
         }
         if (update) {
             if (y_start < 0)
@@ -1103,62 +1461,63 @@ static void vga_draw_graphic(VGAState *s, int full_update)
             if (y_start >= 0) {
                 /* flush to display */
                 dpy_update(s->ds, 0, y_start, 
-                           width, y - y_start);
+                           disp_width, y - y_start);
                 y_start = -1;
             }
         }
-        if (y == s->line_compare) {
-            addr1 = 0;
+        if (!multi_run) {
+            if (!double_scan || (y & 1) != 0) {
+                if (y1 == s->line_compare) {
+                    addr1 = 0;
+                } else {
+                    mask = (s->cr[0x17] & 3) ^ 3;
+                    if ((y1 & mask) == mask)
+                        addr1 += line_offset;
+                }
+                y1++;
+            }
+            multi_run = multi_scan;
         } else {
-            addr1 += line_offset;
+            multi_run--;
+            y1++;
         }
         d += linesize;
     }
     if (y_start >= 0) {
         /* flush to display */
         dpy_update(s->ds, 0, y_start, 
-                   width, y - y_start);
+                   disp_width, y - y_start);
     }
     /* reset modified pages */
     if (page_max != -1) {
-        memset(s->vram_updated + page_min, 0, page_max - page_min + 1);
+        cpu_physical_memory_reset_dirty(page_min, page_max + TARGET_PAGE_SIZE);
     }
 }
 
-/* draw text terminal (very limited, just for simple boot debug
-   messages) */
-static int last_cursor_pos;
-
-void vga_draw_dumb(VGAState *s)
-{
-    int c, i, cursor_pos, eol;
-
-    cursor_pos = s->cr[0x0f] | (s->cr[0x0e] << 8);
-    eol = 0;
-    for(i = last_cursor_pos; i < cursor_pos; i++) {
-        /* XXX: should use vga RAM */
-        c = phys_ram_base[0xb8000 + (i) * 2];
-        if (c >= ' ') {
-            putchar(c);
-            eol = 0;
-        } else {
-            if (!eol)
-                putchar('\n');
-            eol = 1;
-        }
-    }
-    fflush(stdout);
-    last_cursor_pos = cursor_pos;
-}
-
 void vga_update_display(void)
 {
     VGAState *s = &vga_state;
     int full_update, graphic_mode;
 
     if (s->ds->depth == 0) {
-        vga_draw_dumb(s);
+        /* nothing to do */
     } else {
+        switch(s->ds->depth) {
+        case 8:
+            s->rgb_to_pixel = rgb_to_pixel8_dup;
+            break;
+        case 15:
+            s->rgb_to_pixel = rgb_to_pixel15_dup;
+            break;
+        default:
+        case 16:
+            s->rgb_to_pixel = rgb_to_pixel16_dup;
+            break;
+        case 32:
+            s->rgb_to_pixel = rgb_to_pixel32_dup;
+            break;
+        }
+        
         full_update = 0;
         graphic_mode = s->gr[6] & 1;
         if (graphic_mode != s->graphic_mode) {
@@ -1172,34 +1531,128 @@ void vga_update_display(void)
     }
 }
 
-void vga_reset(VGAState *s)
+static void vga_reset(VGAState *s)
 {
     memset(s, 0, sizeof(VGAState));
+#ifdef CONFIG_S3VGA
     /* chip ID for 8c968 */
     s->cr[0x2d] = 0x88;
     s->cr[0x2e] = 0xb0;
     s->cr[0x2f] = 0x01; /* XXX: check revision code */
     s->cr[0x30] = 0xe1;
+#endif
     s->graphic_mode = -1; /* force full update */
 }
 
-CPUReadMemoryFunc *vga_mem_read[3] = {
+static CPUReadMemoryFunc *vga_mem_read[3] = {
     vga_mem_readb,
     vga_mem_readw,
     vga_mem_readl,
 };
 
-CPUWriteMemoryFunc *vga_mem_write[3] = {
+static CPUWriteMemoryFunc *vga_mem_write[3] = {
     vga_mem_writeb,
     vga_mem_writew,
     vga_mem_writel,
 };
 
-int vga_init(DisplayState *ds, uint8_t *vga_ram_base, 
-             unsigned long vga_ram_offset, int vga_ram_size)
+static void vga_save(QEMUFile *f, void *opaque)
+{
+    VGAState *s = opaque;
+    int i;
+
+    qemu_put_be32s(f, &s->latch);
+    qemu_put_8s(f, &s->sr_index);
+    qemu_put_buffer(f, s->sr, 8);
+    qemu_put_8s(f, &s->gr_index);
+    qemu_put_buffer(f, s->gr, 16);
+    qemu_put_8s(f, &s->ar_index);
+    qemu_put_buffer(f, s->ar, 21);
+    qemu_put_be32s(f, &s->ar_flip_flop);
+    qemu_put_8s(f, &s->cr_index);
+    qemu_put_buffer(f, s->cr, 256);
+    qemu_put_8s(f, &s->msr);
+    qemu_put_8s(f, &s->fcr);
+    qemu_put_8s(f, &s->st00);
+    qemu_put_8s(f, &s->st01);
+
+    qemu_put_8s(f, &s->dac_state);
+    qemu_put_8s(f, &s->dac_sub_index);
+    qemu_put_8s(f, &s->dac_read_index);
+    qemu_put_8s(f, &s->dac_write_index);
+    qemu_put_buffer(f, s->dac_cache, 3);
+    qemu_put_buffer(f, s->palette, 768);
+
+    qemu_put_be32s(f, &s->bank_offset);
+#ifdef CONFIG_BOCHS_VBE
+    qemu_put_byte(f, 1);
+    qemu_put_be16s(f, &s->vbe_index);
+    for(i = 0; i < VBE_DISPI_INDEX_NB; i++)
+        qemu_put_be16s(f, &s->vbe_regs[i]);
+    qemu_put_be32s(f, &s->vbe_start_addr);
+    qemu_put_be32s(f, &s->vbe_line_offset);
+    qemu_put_be32s(f, &s->vbe_bank_mask);
+#else
+    qemu_put_byte(f, 0);
+#endif
+}
+
+static int vga_load(QEMUFile *f, void *opaque, int version_id)
+{
+    VGAState *s = opaque;
+    int is_vbe, i;
+
+    if (version_id != 1)
+        return -EINVAL;
+
+    qemu_get_be32s(f, &s->latch);
+    qemu_get_8s(f, &s->sr_index);
+    qemu_get_buffer(f, s->sr, 8);
+    qemu_get_8s(f, &s->gr_index);
+    qemu_get_buffer(f, s->gr, 16);
+    qemu_get_8s(f, &s->ar_index);
+    qemu_get_buffer(f, s->ar, 21);
+    qemu_get_be32s(f, &s->ar_flip_flop);
+    qemu_get_8s(f, &s->cr_index);
+    qemu_get_buffer(f, s->cr, 256);
+    qemu_get_8s(f, &s->msr);
+    qemu_get_8s(f, &s->fcr);
+    qemu_get_8s(f, &s->st00);
+    qemu_get_8s(f, &s->st01);
+
+    qemu_get_8s(f, &s->dac_state);
+    qemu_get_8s(f, &s->dac_sub_index);
+    qemu_get_8s(f, &s->dac_read_index);
+    qemu_get_8s(f, &s->dac_write_index);
+    qemu_get_buffer(f, s->dac_cache, 3);
+    qemu_get_buffer(f, s->palette, 768);
+
+    qemu_get_be32s(f, &s->bank_offset);
+    is_vbe = qemu_get_byte(f);
+#ifdef CONFIG_BOCHS_VBE
+    if (!is_vbe)
+        return -EINVAL;
+    qemu_get_be16s(f, &s->vbe_index);
+    for(i = 0; i < VBE_DISPI_INDEX_NB; i++)
+        qemu_get_be16s(f, &s->vbe_regs[i]);
+    qemu_get_be32s(f, &s->vbe_start_addr);
+    qemu_get_be32s(f, &s->vbe_line_offset);
+    qemu_get_be32s(f, &s->vbe_bank_mask);
+#else
+    if (is_vbe)
+        return -EINVAL;
+#endif
+
+    /* force refresh */
+    s->graphic_mode = -1;
+    return 0;
+}
+
+int vga_initialize(DisplayState *ds, uint8_t *vga_ram_base, 
+                   unsigned long vga_ram_offset, int vga_ram_size)
 {
     VGAState *s = &vga_state;
-    int i, j, v;
+    int i, j, v, b;
 
     for(i = 0;i < 256; i++) {
         v = 0;
@@ -1214,6 +1667,15 @@ int vga_init(DisplayState *ds, uint8_t *vga_ram_base,
         }
         expand2[i] = v;
     }
+    for(i = 0; i < 16; i++) {
+        v = 0;
+        for(j = 0; j < 4; j++) {
+            b = ((i >> j) & 1);
+            v |= b << (2 * j);
+            v |= b << (2 * j + 1);
+        }
+        expand4to8[i] = v;
+    }
 
     vga_reset(s);
 
@@ -1222,21 +1684,124 @@ int vga_init(DisplayState *ds, uint8_t *vga_ram_base,
     s->vram_size = vga_ram_size;
     s->ds = ds;
 
-    register_ioport_write(0x3c0, 16, vga_ioport_write, 1);
+    register_savevm("vga", 0, 1, vga_save, vga_load, s);
+
+    register_ioport_write(0x3c0, 16, 1, vga_ioport_write, s);
 
-    register_ioport_write(0x3b4, 2, vga_ioport_write, 1);
-    register_ioport_write(0x3d4, 2, vga_ioport_write, 1);
-    register_ioport_write(0x3ba, 1, vga_ioport_write, 1);
-    register_ioport_write(0x3da, 1, vga_ioport_write, 1);
+    register_ioport_write(0x3b4, 2, 1, vga_ioport_write, s);
+    register_ioport_write(0x3d4, 2, 1, vga_ioport_write, s);
+    register_ioport_write(0x3ba, 1, 1, vga_ioport_write, s);
+    register_ioport_write(0x3da, 1, 1, vga_ioport_write, s);
 
-    register_ioport_read(0x3c0, 16, vga_ioport_read, 1);
+    register_ioport_read(0x3c0, 16, 1, vga_ioport_read, s);
 
-    register_ioport_read(0x3b4, 2, vga_ioport_read, 1);
-    register_ioport_read(0x3d4, 2, vga_ioport_read, 1);
-    register_ioport_read(0x3ba, 1, vga_ioport_read, 1);
-    register_ioport_read(0x3da, 1, vga_ioport_read, 1);
+    register_ioport_read(0x3b4, 2, 1, vga_ioport_read, s);
+    register_ioport_read(0x3d4, 2, 1, vga_ioport_read, s);
+    register_ioport_read(0x3ba, 1, 1, vga_ioport_read, s);
+    register_ioport_read(0x3da, 1, 1, vga_ioport_read, s);
+    s->bank_offset = -0xa0000;
+
+#ifdef CONFIG_BOCHS_VBE
+    s->vbe_regs[VBE_DISPI_INDEX_ID] = VBE_DISPI_ID0;
+    s->vbe_bank_mask = ((s->vram_size >> 16) - 1);
+    register_ioport_read(0x1ce, 1, 2, vbe_ioport_read, s);
+    register_ioport_read(0x1cf, 1, 2, vbe_ioport_read, s);
+
+    register_ioport_write(0x1ce, 1, 2, vbe_ioport_write, s);
+    register_ioport_write(0x1cf, 1, 2, vbe_ioport_write, s);
+#endif
 
     vga_io_memory = cpu_register_io_memory(0, vga_mem_read, vga_mem_write);
-    cpu_register_physical_memory(0xa0000, 0x20000, vga_io_memory);
+#if defined (TARGET_I386)
+    cpu_register_physical_memory(0x000a0000, 0x20000, vga_io_memory);
+#ifdef CONFIG_BOCHS_VBE
+    /* XXX: use optimized standard vga accesses */
+    cpu_register_physical_memory(VBE_DISPI_LFB_PHYSICAL_ADDRESS, 
+                                 vga_ram_size, vga_ram_offset);
+#endif
+#elif defined (TARGET_PPC)
+    cpu_register_physical_memory(0xf00a0000, 0x20000, vga_io_memory);
+#endif
+    return 0;
+}
+
+/********************************************************/
+/* vga screen dump */
+
+static int vga_save_w, vga_save_h;
+
+static void vga_save_dpy_update(DisplayState *s, 
+                                int x, int y, int w, int h)
+{
+}
+
+static void vga_save_dpy_resize(DisplayState *s, int w, int h)
+{
+    s->linesize = w * 4;
+    s->data = qemu_malloc(h * s->linesize);
+    vga_save_w = w;
+    vga_save_h = h;
+}
+
+static void vga_save_dpy_refresh(DisplayState *s)
+{
+}
+
+static int ppm_save(const char *filename, uint8_t *data, 
+                    int w, int h, int linesize)
+{
+    FILE *f;
+    uint8_t *d, *d1;
+    unsigned int v;
+    int y, x;
+
+    f = fopen(filename, "wb");
+    if (!f)
+        return -1;
+    fprintf(f, "P6\n%d %d\n%d\n",
+            w, h, 255);
+    d1 = data;
+    for(y = 0; y < h; y++) {
+        d = d1;
+        for(x = 0; x < w; x++) {
+            v = *(uint32_t *)d;
+            fputc((v >> 16) & 0xff, f);
+            fputc((v >> 8) & 0xff, f);
+            fputc((v) & 0xff, f);
+            d += 4;
+        }
+        d1 += linesize;
+    }
+    fclose(f);
     return 0;
 }
+
+/* save the vga display in a PPM image even if no display is
+   available */
+void vga_screen_dump(const char *filename)
+{
+    VGAState *s = &vga_state;
+    DisplayState *saved_ds, ds1, *ds = &ds1;
+    
+    /* XXX: this is a little hackish */
+    s->last_width = -1;
+    s->last_height = -1;
+    saved_ds = s->ds;
+
+    memset(ds, 0, sizeof(DisplayState));
+    ds->dpy_update = vga_save_dpy_update;
+    ds->dpy_resize = vga_save_dpy_resize;
+    ds->dpy_refresh = vga_save_dpy_refresh;
+    ds->depth = 32;
+
+    s->ds = ds;
+    s->graphic_mode = -1;
+    vga_update_display();
+    
+    if (ds->data) {
+        ppm_save(filename, ds->data, vga_save_w, vga_save_h, 
+                 s->ds->linesize);
+        qemu_free(ds->data);
+    }
+    s->ds = saved_ds;
+}