[PATCH] ati-vga: Fix framebuffer mapping by using hardware-correct aperture sizes

[Chad Jablonski <chad@jablonski.xyz>]

Real Rage 128 cards always request 64MB for their linear (framebuffer)
aperture. This is regardless of the amount of physical VRAM on the
board. This is required for 64MB alignment which is important given the
26-bit addressing in src and dst registers.

This discrepancy caused X to segfault or display garbage depending on
the version tested. X expects this 64MB alignment.

This was confirmed by testing against the behavior of real 16MB and 32MB
Rage 128 cards.

Real Radeon R100 cards request 128MB for linear aperture. This was
tested against a Radeon 7200 with 64MB of VRAM.

Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
---
 hw/display/ati.c     | 26 ++++++++++++++++++++++++--
 hw/display/ati_int.h |  1 +
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index f7c0006a87..db189e0767 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -30,9 +30,13 @@
 #include "ui/console.h"
 #include "hw/display/i2c-ddc.h"
 #include "trace.h"
+#include "qemu/units.h"
 
 #define ATI_DEBUG_HW_CURSOR 0
 
+#define ATI_RAGE128_LINEAR_APERTURE_SIZE (64 * MiB)
+#define ATI_RADEON_LINEAR_APERTURE_SIZE (128 * MiB)
+
 #ifdef CONFIG_PIXMAN
 #define DEFAULT_X_PIXMAN 3
 #else
@@ -361,7 +365,7 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
                                       PCI_BASE_ADDRESS_0, size) & 0xfffffff0;
         break;
     case CONFIG_APER_SIZE:
-        val = s->vga.vram_size / 2;
+        val = memory_region_size(&s->linear_aper);
         break;
     case CONFIG_REG_1_BASE:
         val = pci_default_read_config(&s->dev,
@@ -1011,7 +1015,25 @@ static void ati_vga_realize(PCIDevice *dev, Error **errp)
     /* io space is alias to beginning of mmregs */
     memory_region_init_alias(&s->io, OBJECT(s), "ati.io", &s->mm, 0, 0x100);
 
-    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &vga->vram);
+    uint64_t aperture_size;
+    if (s->dev_id == PCI_DEVICE_ID_ATI_RADEON_QY) {
+        aperture_size = ATI_RADEON_LINEAR_APERTURE_SIZE;
+    } else {
+        aperture_size = ATI_RAGE128_LINEAR_APERTURE_SIZE;
+    }
+    memory_region_init(&s->linear_aper, OBJECT(dev), "ati-linear-aperture0",
+                       aperture_size);
+
+    /*
+     * Rage 128: Framebuffer inhabits the bottom 32MB of the linear aperture.
+     *           The top 32MB is reserved for AGP (not implemented).
+     *
+     * Radeon: The entire linear aperture is used for VRAM.
+     *         AGP is mapped separately.
+     */
+    memory_region_add_subregion(&s->linear_aper, 0, &vga->vram);
+
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->linear_aper);
     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mm);
 
diff --git a/hw/display/ati_int.h b/hw/display/ati_int.h
index f5a47b82b0..ff2a69a0a5 100644
--- a/hw/display/ati_int.h
+++ b/hw/display/ati_int.h
@@ -97,6 +97,7 @@ struct ATIVGAState {
     QEMUCursor *cursor;
     QEMUTimer vblank_timer;
     bitbang_i2c_interface bbi2c;
+    MemoryRegion linear_aper;
     MemoryRegion io;
     MemoryRegion mm;
     ATIVGARegs regs;
-- 
2.51.0