6 files changed, 509 insertions, 176 deletions

diff --git a/src/core/hle/config_mem.h b/src/core/hle/config_mem.h
index da396a3e6..fa01b5cdb 100644
--- a/src/core/hle/config_mem.h
+++ b/src/core/hle/config_mem.h
@@ -1,10 +1,10 @@
 // Copyright 2014 Citra Emulator Project
 // Licensed under GPLv2
-// Refer to the license.txt file included.  
+// Refer to the license.txt file included.
 
 #pragma once
 
-// Configuration memory stores various hardware/kernel configuration settings. This memory page is 
+// Configuration memory stores various hardware/kernel configuration settings. This memory page is
 // read-only for ARM11 processes. I'm guessing this would normally be written to by the firmware/
 // bootrom. Because we're not emulating this, and essentially just "stubbing" the functionality, I'm
 // putting this as a subset of HLE for now.
@@ -16,6 +16,6 @@
 namespace ConfigMem {
 
 template <typename T>
-inline void Read(T &var, const u32 addr);
+void Read(T &var, const u32 addr);
 
 } // namespace
diff --git a/src/core/hle/service/gsp.cpp b/src/core/hle/service/gsp.cpp
index 1fdbdf342..b20203e27 100644
--- a/src/core/hle/service/gsp.cpp
+++ b/src/core/hle/service/gsp.cpp
@@ -47,11 +47,6 @@ Handle g_shared_memory = 0;
 
 u32 g_thread_id = 0;
 
-enum {
-    REG_FRAMEBUFFER_1   = 0x00400468,
-    REG_FRAMEBUFFER_2   = 0x00400494,
-};
-
 /// Gets a pointer to the start (header) of a command buffer in GSP shared memory
 static inline u8* GX_GetCmdBufferPointer(u32 thread_id, u32 offset=0) {
     return Kernel::GetSharedMemoryPointer(g_shared_memory, 0x800 + (thread_id * 0x200) + offset);
@@ -67,38 +62,62 @@ void GX_FinishCommand(u32 thread_id) {
     // TODO: Increment header->index?
 }
 
+/// Write a GSP GPU hardware register
+void WriteHWRegs(Service::Interface* self) {
+    u32* cmd_buff = Service::GetCommandBuffer();
+    u32 reg_addr = cmd_buff[1];
+    u32 size = cmd_buff[2];
+
+    // TODO: Return proper error codes
+    if (reg_addr + size >= 0x420000) {
+        ERROR_LOG(GPU, "Write address out of range! (address=0x%08x, size=0x%08x)", reg_addr, size);
+        return;
+    }
+
+    // size should be word-aligned
+    if ((size % 4) != 0) {
+        ERROR_LOG(GPU, "Invalid size 0x%08x", size);
+        return;
+    }
+
+    u32* src = (u32*)Memory::GetPointer(cmd_buff[0x4]);
+
+    while (size > 0) {
+        GPU::Write<u32>(reg_addr + 0x1EB00000, *src);
+
+        size -= 4;
+        ++src;
+        reg_addr += 4;
+    }
+}
+
 /// Read a GSP GPU hardware register
 void ReadHWRegs(Service::Interface* self) {
-    static const u32 framebuffer_1[] = {GPU::PADDR_VRAM_TOP_LEFT_FRAME1, GPU::PADDR_VRAM_TOP_RIGHT_FRAME1};
-    static const u32 framebuffer_2[] = {GPU::PADDR_VRAM_TOP_LEFT_FRAME2, GPU::PADDR_VRAM_TOP_RIGHT_FRAME2};
-
     u32* cmd_buff = Service::GetCommandBuffer();
     u32 reg_addr = cmd_buff[1];
     u32 size = cmd_buff[2];
-    u32* dst = (u32*)Memory::GetPointer(cmd_buff[0x41]);
 
-    switch (reg_addr) {
+    // TODO: Return proper error codes
+    if (reg_addr + size >= 0x420000) {
+        ERROR_LOG(GPU, "Read address out of range! (address=0x%08x, size=0x%08x)", reg_addr, size);
+        return;
+    }
 
-    // NOTE: Calling SetFramebufferLocation here is a hack... Not sure the correct way yet to set 
-    // whether the framebuffers should be in VRAM or GSP heap, but from what I understand, if the 
-    // user application is reading from either of these registers, then its going to be in VRAM.
+    // size should be word-aligned
+    if ((size % 4) != 0) {
+        ERROR_LOG(GPU, "Invalid size 0x%08x", size);
+        return;
+    }
 
-    // Top framebuffer 1 addresses
-    case REG_FRAMEBUFFER_1:
-        GPU::SetFramebufferLocation(GPU::FRAMEBUFFER_LOCATION_VRAM);
-        memcpy(dst, framebuffer_1, size);
-        break;
+    u32* dst = (u32*)Memory::GetPointer(cmd_buff[0x41]);
 
-    // Top framebuffer 2 addresses
-    case REG_FRAMEBUFFER_2:
-        GPU::SetFramebufferLocation(GPU::FRAMEBUFFER_LOCATION_VRAM);
-        memcpy(dst, framebuffer_2, size);
-        break;
+    while (size > 0) {
+        GPU::Read<u32>(*dst, reg_addr + 0x1EB00000);
 
-    default:
-        ERROR_LOG(GSP, "unknown register read at address %08X", reg_addr);
+        size -= 4;
+        ++dst;
+        reg_addr += 4;
     }
-
 }
 
 /**
@@ -120,8 +139,8 @@ void RegisterInterruptRelayQueue(Service::Interface* self) {
 
     Kernel::SetEventLocked(g_event, false);
 
-    // Hack - This function will permanently set the state of the GSP event such that GPU command 
-    // synchronization barriers always passthrough. Correct solution would be to set this after the 
+    // Hack - This function will permanently set the state of the GSP event such that GPU command
+    // synchronization barriers always passthrough. Correct solution would be to set this after the
     // GPU as processed all queued up commands, but due to the emulator being single-threaded they
     // will always be ready.
     Kernel::SetPermanentLock(g_event, true);
@@ -134,52 +153,92 @@ void RegisterInterruptRelayQueue(Service::Interface* self) {
 
 /// This triggers handling of the GX command written to the command buffer in shared memory.
 void TriggerCmdReqQueue(Service::Interface* self) {
+
+    // Utility function to convert register ID to address
+    auto WriteGPURegister = [](u32 id, u32 data) {
+        GPU::Write<u32>(0x1EF00000 + 4 * id, data);
+    };
+
     GX_CmdBufferHeader* header = (GX_CmdBufferHeader*)GX_GetCmdBufferPointer(g_thread_id);
-    u32* cmd_buff = (u32*)GX_GetCmdBufferPointer(g_thread_id, 0x20 + (header->index * 0x20));
+    auto& command = *(const GXCommand*)GX_GetCmdBufferPointer(g_thread_id, 0x20 + (header->index * 0x20));
 
-    switch (static_cast<GXCommandId>(cmd_buff[0])) {
+    switch (command.id) {
 
     // GX request DMA - typically used for copying memory from GSP heap to VRAM
     case GXCommandId::REQUEST_DMA:
-        memcpy(Memory::GetPointer(cmd_buff[2]), Memory::GetPointer(cmd_buff[1]), cmd_buff[3]);
+        memcpy(Memory::GetPointer(command.dma_request.dest_address),
+               Memory::GetPointer(command.dma_request.source_address),
+               command.dma_request.size);
         break;
 
+    // ctrulib homebrew sends all relevant command list data with this command,
+    // hence we do all "interesting" stuff here and do nothing in SET_COMMAND_LIST_FIRST.
+    // TODO: This will need some rework in the future.
     case GXCommandId::SET_COMMAND_LIST_LAST:
-        GPU::Write<u32>(GPU::Registers::CommandListAddress, cmd_buff[1] >> 3);
-        GPU::Write<u32>(GPU::Registers::CommandListSize, cmd_buff[2] >> 3);
-        GPU::Write<u32>(GPU::Registers::ProcessCommandList, 1); // TODO: Not sure if we are supposed to always write this
+    {
+        auto& params = command.set_command_list_last;
+        WriteGPURegister(GPU::Regs::CommandProcessor + 2, params.address >> 3);
+        WriteGPURegister(GPU::Regs::CommandProcessor, params.size >> 3);
+        WriteGPURegister(GPU::Regs::CommandProcessor + 4, 1); // TODO: Not sure if we are supposed to always write this .. seems to trigger processing though
 
         // TODO: Move this to GPU
         // TODO: Not sure what units the size is measured in
-        g_debugger.CommandListCalled(cmd_buff[1], (u32*)Memory::GetPointer(cmd_buff[1]), cmd_buff[2]);
+        g_debugger.CommandListCalled(params.address,
+                                     (u32*)Memory::GetPointer(params.address),
+                                     params.size);
         break;
+    }
 
+    // It's assumed that the two "blocks" behave equivalently.
+    // Presumably this is done simply to allow two memory fills to run in parallel.
     case GXCommandId::SET_MEMORY_FILL:
+    {
+        auto& params = command.memory_fill;
+        WriteGPURegister(GPU::Regs::MemoryFill, params.start1 >> 3);
+        WriteGPURegister(GPU::Regs::MemoryFill + 1, params.end1 >> 3);
+        WriteGPURegister(GPU::Regs::MemoryFill + 2, params.end1 - params.start1);
+        WriteGPURegister(GPU::Regs::MemoryFill + 3, params.value1);
+
+        WriteGPURegister(GPU::Regs::MemoryFill + 4, params.start2 >> 3);
+        WriteGPURegister(GPU::Regs::MemoryFill + 5, params.end2 >> 3);
+        WriteGPURegister(GPU::Regs::MemoryFill + 6, params.end2 - params.start2);
+        WriteGPURegister(GPU::Regs::MemoryFill + 7, params.value2);
         break;
+    }
 
+    // TODO: Check if texture copies are implemented correctly..
     case GXCommandId::SET_DISPLAY_TRANSFER:
-        break;
-
     case GXCommandId::SET_TEXTURE_COPY:
+    {
+        auto& params = command.image_copy;
+        WriteGPURegister(GPU::Regs::DisplayTransfer, params.in_buffer_address >> 3);
+        WriteGPURegister(GPU::Regs::DisplayTransfer + 1, params.out_buffer_address >> 3);
+        WriteGPURegister(GPU::Regs::DisplayTransfer + 3, params.in_buffer_size);
+        WriteGPURegister(GPU::Regs::DisplayTransfer + 2, params.out_buffer_size);
+        WriteGPURegister(GPU::Regs::DisplayTransfer + 4, params.flags);
+
+        // TODO: Should this only be ORed with 1 for texture copies?
+        // trigger transfer
+        WriteGPURegister(GPU::Regs::DisplayTransfer + 6, 1);
         break;
+    }
 
+    // TODO: Figure out what exactly SET_COMMAND_LIST_FIRST and SET_COMMAND_LIST_LAST
+    //       are supposed to do.
     case GXCommandId::SET_COMMAND_LIST_FIRST:
     {
-        //u32* buf0_data = (u32*)Memory::GetPointer(cmd_buff[1]);
-        //u32* buf1_data = (u32*)Memory::GetPointer(cmd_buff[3]);
-        //u32* buf2_data = (u32*)Memory::GetPointer(cmd_buff[5]);
         break;
     }
 
     default:
-        ERROR_LOG(GSP, "unknown command 0x%08X", cmd_buff[0]);
+        ERROR_LOG(GSP, "unknown command 0x%08X", (int)command.id.Value());
     }
 
     GX_FinishCommand(g_thread_id);
 }
 
 const Interface::FunctionInfo FunctionTable[] = {
-    {0x00010082, nullptr,                       "WriteHWRegs"},
+    {0x00010082, WriteHWRegs,                   "WriteHWRegs"},
     {0x00020084, nullptr,                       "WriteHWRegsWithMask"},
     {0x00030082, nullptr,                       "WriteHWRegRepeat"},
     {0x00040080, ReadHWRegs,                    "ReadHWRegs"},
diff --git a/src/core/hle/service/gsp.h b/src/core/hle/service/gsp.h
index 214de140f..a83cb4846 100644
--- a/src/core/hle/service/gsp.h
+++ b/src/core/hle/service/gsp.h
@@ -4,6 +4,7 @@
 
 #pragma once
 
+#include "common/bit_field.h"
 #include "core/hle/service/service.h"
 
 ////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -12,21 +13,58 @@
 namespace GSP_GPU {
 
 enum class GXCommandId : u32 {
-    REQUEST_DMA            = 0x00000000,
-    SET_COMMAND_LIST_LAST  = 0x00000001,
-    SET_MEMORY_FILL        = 0x00000002, // TODO: Confirm? (lictru uses 0x01000102)
-    SET_DISPLAY_TRANSFER   = 0x00000003,
-    SET_TEXTURE_COPY       = 0x00000004,
-    SET_COMMAND_LIST_FIRST = 0x00000005,
+    REQUEST_DMA            = 0x00,
+    SET_COMMAND_LIST_LAST  = 0x01,
+
+    // Fills a given memory range with a particular value
+    SET_MEMORY_FILL        = 0x02,
+
+    // Copies an image and optionally performs color-conversion or scaling.
+    // This is highly similar to the GameCube's EFB copy feature
+    SET_DISPLAY_TRANSFER   = 0x03,
+
+    // Conceptionally similar to SET_DISPLAY_TRANSFER and presumable uses the same hardware path
+    SET_TEXTURE_COPY       = 0x04,
+
+    SET_COMMAND_LIST_FIRST = 0x05,
 };
 
-union GXCommand {
-    struct {
-        GXCommandId id;
-    };
+struct GXCommand {
+    BitField<0, 8, GXCommandId> id;
 
-    u32 data[0x20];
+    union {
+        struct {
+            u32 source_address;
+            u32 dest_address;
+            u32 size;
+        } dma_request;
+
+        struct {
+            u32 address;
+            u32 size;
+        } set_command_list_last;
+
+        struct {
+            u32 start1;
+            u32 value1;
+            u32 end1;
+            u32 start2;
+            u32 value2;
+            u32 end2;
+        } memory_fill;
+
+        struct {
+            u32 in_buffer_address;
+            u32 out_buffer_address;
+            u32 in_buffer_size;
+            u32 out_buffer_size;
+            u32 flags;
+        } image_copy;
+
+        u8 raw_data[0x1C];
+    };
 };
+static_assert(sizeof(GXCommand) == 0x20, "GXCommand struct has incorrect size");
 
 /// Interface to "srv:" service
 class Interface : public Service::Interface {
diff --git a/src/core/hw/gpu.cpp b/src/core/hw/gpu.cpp
index f0ca4eada..c00be2a83 100644
--- a/src/core/hw/gpu.cpp
+++ b/src/core/hw/gpu.cpp
@@ -15,48 +15,58 @@
 
 namespace GPU {
 
-Registers g_regs;
+RegisterSet<u32, Regs> g_regs;
 
 u64 g_last_ticks = 0; ///< Last CPU ticks
 
 /**
  * Sets whether the framebuffers are in the GSP heap (FCRAM) or VRAM
- * @param 
+ * @param
  */
 void SetFramebufferLocation(const FramebufferLocation mode) {
     switch (mode) {
     case FRAMEBUFFER_LOCATION_FCRAM:
-        g_regs.framebuffer_top_left_1   = PADDR_TOP_LEFT_FRAME1;
-        g_regs.framebuffer_top_left_2   = PADDR_TOP_LEFT_FRAME2;
-        g_regs.framebuffer_top_right_1  = PADDR_TOP_RIGHT_FRAME1;
-        g_regs.framebuffer_top_right_2  = PADDR_TOP_RIGHT_FRAME2;
-        g_regs.framebuffer_sub_left_1   = PADDR_SUB_FRAME1;
-        //g_regs.framebuffer_sub_left_2  = unknown;
-        g_regs.framebuffer_sub_right_1  = PADDR_SUB_FRAME2;
-        //g_regs.framebufferr_sub_right_2 = unknown;
+    {
+        auto& framebuffer_top = g_regs.Get<Regs::FramebufferTop>();
+        auto& framebuffer_sub = g_regs.Get<Regs::FramebufferBottom>();
+
+        framebuffer_top.address_left1  = PADDR_TOP_LEFT_FRAME1;
+        framebuffer_top.address_left2  = PADDR_TOP_LEFT_FRAME2;
+        framebuffer_top.address_right1 = PADDR_TOP_RIGHT_FRAME1;
+        framebuffer_top.address_right2 = PADDR_TOP_RIGHT_FRAME2;
+        framebuffer_sub.address_left1  = PADDR_SUB_FRAME1;
+        //framebuffer_sub.address_left2  = unknown;
+        framebuffer_sub.address_right1 = PADDR_SUB_FRAME2;
+        //framebuffer_sub.address_right2 = unknown;
         break;
+    }
 
     case FRAMEBUFFER_LOCATION_VRAM:
-        g_regs.framebuffer_top_left_1   = PADDR_VRAM_TOP_LEFT_FRAME1;
-        g_regs.framebuffer_top_left_2   = PADDR_VRAM_TOP_LEFT_FRAME2;
-        g_regs.framebuffer_top_right_1  = PADDR_VRAM_TOP_RIGHT_FRAME1;
-        g_regs.framebuffer_top_right_2  = PADDR_VRAM_TOP_RIGHT_FRAME2;
-        g_regs.framebuffer_sub_left_1   = PADDR_VRAM_SUB_FRAME1;
-        //g_regs.framebuffer_sub_left_2  = unknown;
-        g_regs.framebuffer_sub_right_1  = PADDR_VRAM_SUB_FRAME2;
-        //g_regs.framebufferr_sub_right_2 = unknown;
+    {
+        auto& framebuffer_top = g_regs.Get<Regs::FramebufferTop>();
+        auto& framebuffer_sub = g_regs.Get<Regs::FramebufferBottom>();
+
+        framebuffer_top.address_left1  = PADDR_VRAM_TOP_LEFT_FRAME1;
+        framebuffer_top.address_left2  = PADDR_VRAM_TOP_LEFT_FRAME2;
+        framebuffer_top.address_right1 = PADDR_VRAM_TOP_RIGHT_FRAME1;
+        framebuffer_top.address_right2 = PADDR_VRAM_TOP_RIGHT_FRAME2;
+        framebuffer_sub.address_left1  = PADDR_VRAM_SUB_FRAME1;
+        //framebuffer_sub.address_left2  = unknown;
+        framebuffer_sub.address_right1 = PADDR_VRAM_SUB_FRAME2;
+        //framebuffer_sub.address_right2 = unknown;
         break;
     }
+    }
 }
 
 /**
  * Gets the location of the framebuffers
  * @return Location of framebuffers as FramebufferLocation enum
  */
-const FramebufferLocation GetFramebufferLocation() {
-    if ((g_regs.framebuffer_top_right_1 & ~Memory::VRAM_MASK) == Memory::VRAM_PADDR) {
+FramebufferLocation GetFramebufferLocation(u32 address) {
+    if ((address & ~Memory::VRAM_MASK) == Memory::VRAM_PADDR) {
         return FRAMEBUFFER_LOCATION_VRAM;
-    } else if ((g_regs.framebuffer_top_right_1 & ~Memory::FCRAM_MASK) == Memory::FCRAM_PADDR) {
+    } else if ((address & ~Memory::FCRAM_MASK) == Memory::FCRAM_PADDR) {
         return FRAMEBUFFER_LOCATION_FCRAM;
     } else {
         ERROR_LOG(GPU, "unknown framebuffer location!");
@@ -64,91 +74,161 @@ const FramebufferLocation GetFramebufferLocation() {
     return FRAMEBUFFER_LOCATION_UNKNOWN;
 }
 
+u32 GetFramebufferAddr(const u32 address) {
+    switch (GetFramebufferLocation(address)) {
+    case FRAMEBUFFER_LOCATION_FCRAM:
+        return Memory::VirtualAddressFromPhysical_FCRAM(address);
+    case FRAMEBUFFER_LOCATION_VRAM:
+        return Memory::VirtualAddressFromPhysical_VRAM(address);
+    default:
+        ERROR_LOG(GPU, "unknown framebuffer location");
+    }
+    return 0;
+}
+
 /**
  * Gets a read-only pointer to a framebuffer in memory
  * @param address Physical address of framebuffer
  * @return Returns const pointer to raw framebuffer
  */
 const u8* GetFramebufferPointer(const u32 address) {
-    switch (GetFramebufferLocation()) {
-    case FRAMEBUFFER_LOCATION_FCRAM:
-        return (const u8*)Memory::GetPointer(Memory::VirtualAddressFromPhysical_FCRAM(address));
-    case FRAMEBUFFER_LOCATION_VRAM:
-        return (const u8*)Memory::GetPointer(Memory::VirtualAddressFromPhysical_VRAM(address));
-    default:
-        ERROR_LOG(GPU, "unknown framebuffer location");
-    }
-    return NULL;
+    u32 addr = GetFramebufferAddr(address);
+    return (addr != 0) ? Memory::GetPointer(addr) : nullptr;
 }
 
 template <typename T>
-inline void Read(T &var, const u32 addr) {
-    switch (addr) {
-    case Registers::FramebufferTopLeft1:
-        var = g_regs.framebuffer_top_left_1;
-        break;
+inline void Read(T &var, const u32 raw_addr) {
+    u32 addr = raw_addr - 0x1EF00000;
+    int index = addr / 4;
 
-    case Registers::FramebufferTopLeft2:
-        var = g_regs.framebuffer_top_left_2;
-        break;
+    // Reads other than u32 are untested, so I'd rather have them abort than silently fail
+    if (index >= Regs::NumIds || !std::is_same<T,u32>::value)
+    {
+        ERROR_LOG(GPU, "unknown Read%d @ 0x%08X", sizeof(var) * 8, addr);
+        return;
+    }
 
-    case Registers::FramebufferTopRight1:
-        var = g_regs.framebuffer_top_right_1;
-        break;
+    var = g_regs[static_cast<Regs::Id>(addr / 4)];
+}
 
-    case Registers::FramebufferTopRight2:
-        var = g_regs.framebuffer_top_right_2;
-        break;
+template <typename T>
+inline void Write(u32 addr, const T data) {
+    addr -= 0x1EF00000;
+    int index = addr / 4;
 
-    case Registers::FramebufferSubLeft1:
-        var = g_regs.framebuffer_sub_left_1;
-        break;
+    // Writes other than u32 are untested, so I'd rather have them abort than silently fail
+    if (index >= Regs::NumIds || !std::is_same<T,u32>::value)
+    {
+        ERROR_LOG(GPU, "unknown Write%d 0x%08X @ 0x%08X", sizeof(data) * 8, data, addr);
+        return;
+    }
 
-    case Registers::FramebufferSubRight1:
-        var = g_regs.framebuffer_sub_right_1;
-        break;
+    g_regs[static_cast<Regs::Id>(index)] = data;
 
-    case Registers::CommandListSize:
-        var = g_regs.command_list_size;
-        break;
+    switch (static_cast<Regs::Id>(index)) {
 
-    case Registers::CommandListAddress:
-        var = g_regs.command_list_address;
-        break;
+    // Memory fills are triggered once the fill value is written.
+    // NOTE: This is not verified.
+    case Regs::MemoryFill + 3:
+    case Regs::MemoryFill + 7:
+    {
+        const auto& config = g_regs.Get<Regs::MemoryFill>(static_cast<Regs::Id>(index - 3));
 
-    case Registers::ProcessCommandList:
-        var = g_regs.command_processing_enabled;
-        break;
+        // TODO: Not sure if this check should be done at GSP level instead
+        if (config.address_start) {
+            // TODO: Not sure if this algorithm is correct, particularly because it doesn't use the size member at all
+            u32* start = (u32*)Memory::GetPointer(config.GetStartAddress());
+            u32* end = (u32*)Memory::GetPointer(config.GetEndAddress());
+            for (u32* ptr = start; ptr < end; ++ptr)
+                *ptr = bswap32(config.value); // TODO: This is just a workaround to missing framebuffer format emulation
 
-    default:
-        ERROR_LOG(GPU, "unknown Read%d @ 0x%08X", sizeof(var) * 8, addr);
+            DEBUG_LOG(GPU, "MemoryFill from 0x%08x to 0x%08x", config.GetStartAddress(), config.GetEndAddress());
+        }
         break;
     }
-}
-
-template <typename T>
-inline void Write(u32 addr, const T data) {
-    switch (static_cast<Registers::Id>(addr)) {
-    case Registers::CommandListSize:
-        g_regs.command_list_size = data;
-        break;
 
-    case Registers::CommandListAddress:
-        g_regs.command_list_address = data;
+    case Regs::DisplayTransfer + 6:
+    {
+        const auto& config = g_regs.Get<Regs::DisplayTransfer>();
+        if (config.trigger & 1) {
+            u8* source_pointer = Memory::GetPointer(config.GetPhysicalInputAddress());
+            u8* dest_pointer = Memory::GetPointer(config.GetPhysicalOutputAddress());
+
+            for (int y = 0; y < config.output_height; ++y) {
+                // TODO: Why does the register seem to hold twice the framebuffer width?
+                for (int x = 0; x < config.output_width / 2; ++x) {
+                    struct {
+                        int r, g, b, a;
+                    } source_color = { 0, 0, 0, 0 };
+
+                    switch (config.input_format) {
+                    case Regs::FramebufferFormat::RGBA8:
+                    {
+                        // TODO: Most likely got the component order messed up.
+                        u8* srcptr = source_pointer + x * 4 + y * config.input_width * 4 / 2;
+                        source_color.r = srcptr[0]; // blue
+                        source_color.g = srcptr[1]; // green
+                        source_color.b = srcptr[2]; // red
+                        source_color.a = srcptr[3]; // alpha
+                        break;
+                    }
+
+                    default:
+                        ERROR_LOG(GPU, "Unknown source framebuffer format %x", config.input_format.Value());
+                        break;
+                    }
+
+                    switch (config.output_format) {
+                    /*case Regs::FramebufferFormat::RGBA8:
+                    {
+                        // TODO: Untested
+                        u8* dstptr = (u32*)(dest_pointer + x * 4 + y * config.output_width * 4);
+                        dstptr[0] = source_color.r;
+                        dstptr[1] = source_color.g;
+                        dstptr[2] = source_color.b;
+                        dstptr[3] = source_color.a;
+                        break;
+                    }*/
+
+                    case Regs::FramebufferFormat::RGB8:
+                    {
+                        // TODO: Most likely got the component order messed up.
+                        u8* dstptr = dest_pointer + x * 3 + y * config.output_width * 3 / 2;
+                        dstptr[0] = source_color.r; // blue
+                        dstptr[1] = source_color.g; // green
+                        dstptr[2] = source_color.b; // red
+                        break;
+                    }
+
+                    default:
+                        ERROR_LOG(GPU, "Unknown destination framebuffer format %x", config.output_format.Value());
+                        break;
+                    }
+                }
+            }
+
+            DEBUG_LOG(GPU, "DisplayTriggerTransfer: 0x%08x bytes from 0x%08x(%dx%d)-> 0x%08x(%dx%d), dst format %x",
+                      config.output_height * config.output_width * 4,
+                      config.GetPhysicalInputAddress(), (int)config.input_width, (int)config.input_height,
+                      config.GetPhysicalOutputAddress(), (int)config.output_width, (int)config.output_height,
+                      config.output_format.Value());
+        }
         break;
+    }
 
-    case Registers::ProcessCommandList:
-        g_regs.command_processing_enabled = data;
-        if (g_regs.command_processing_enabled & 1)
+    case Regs::CommandProcessor + 4:
+    {
+        const auto& config = g_regs.Get<Regs::CommandProcessor>();
+        if (config.trigger & 1)
         {
-            // u32* buffer = (u32*)Memory::GetPointer(g_regs.command_list_address << 3);
-            ERROR_LOG(GPU, "Beginning %x bytes of commands from address %x", g_regs.command_list_size, g_regs.command_list_address << 3);
+            // u32* buffer = (u32*)Memory::GetPointer(config.address << 3);
+            ERROR_LOG(GPU, "Beginning 0x%08x bytes of commands from address 0x%08x", config.size, config.address << 3);
             // TODO: Process command list!
         }
         break;
+    }
 
     default:
-        ERROR_LOG(GPU, "unknown Write%d 0x%08X @ 0x%08X", sizeof(data) * 8, data, addr);
         break;
     }
 }
@@ -180,7 +260,24 @@ void Update() {
 /// Initialize hardware
 void Init() {
     g_last_ticks = Core::g_app_core->GetTicks();
-    SetFramebufferLocation(FRAMEBUFFER_LOCATION_FCRAM);
+//    SetFramebufferLocation(FRAMEBUFFER_LOCATION_FCRAM);
+    SetFramebufferLocation(FRAMEBUFFER_LOCATION_VRAM);
+
+    auto& framebuffer_top = g_regs.Get<Regs::FramebufferTop>();
+    auto& framebuffer_sub = g_regs.Get<Regs::FramebufferBottom>();
+    // TODO: Width should be 240 instead?
+    framebuffer_top.width = 480;
+    framebuffer_top.height = 400;
+    framebuffer_top.stride = 480*3;
+    framebuffer_top.color_format = Regs::FramebufferFormat::RGB8;
+    framebuffer_top.active_fb = 0;
+
+    framebuffer_sub.width = 480;
+    framebuffer_sub.height = 400;
+    framebuffer_sub.stride = 480*3;
+    framebuffer_sub.color_format = Regs::FramebufferFormat::RGB8;
+    framebuffer_sub.active_fb = 0;
+
     NOTICE_LOG(GPU, "initialized OK");
 }
 
diff --git a/src/core/hw/gpu.h b/src/core/hw/gpu.h
index 3314ba989..42f18a0e7 100644
--- a/src/core/hw/gpu.h
+++ b/src/core/hw/gpu.h
@@ -5,43 +5,168 @@
 #pragma once
 
 #include "common/common_types.h"
+#include "common/bit_field.h"
+#include "common/register_set.h"
 
 namespace GPU {
 
 static const u32 kFrameCycles   = 268123480 / 60;   ///< 268MHz / 60 frames per second
 static const u32 kFrameTicks    = kFrameCycles / 3; ///< Approximate number of instructions/frame
 
-struct Registers {
+// MMIO region 0x1EFxxxxx
+struct Regs {
     enum Id : u32 {
-        FramebufferTopLeft1     = 0x1EF00468,   // Main LCD, first framebuffer for 3D left
-        FramebufferTopLeft2     = 0x1EF0046C,   // Main LCD, second framebuffer for 3D left
-        FramebufferTopRight1    = 0x1EF00494,   // Main LCD, first framebuffer for 3D right
-        FramebufferTopRight2    = 0x1EF00498,   // Main LCD, second framebuffer for 3D right
-        FramebufferSubLeft1     = 0x1EF00568,   // Sub LCD, first framebuffer
-        FramebufferSubLeft2     = 0x1EF0056C,   // Sub LCD, second framebuffer
-        FramebufferSubRight1    = 0x1EF00594,   // Sub LCD, unused first framebuffer
-        FramebufferSubRight2    = 0x1EF00598,   // Sub LCD, unused second framebuffer
-
-        CommandListSize         = 0x1EF018E0,
-        CommandListAddress      = 0x1EF018E8,
-        ProcessCommandList      = 0x1EF018F0,
+        MemoryFill                = 0x00004, // + 5,6,7; second block at 8-11
+
+        FramebufferTop            = 0x00117, // + 11a,11b,11c,11d(?),11e...126
+        FramebufferBottom         = 0x00157, // + 15a,15b,15c,15d(?),15e...166
+
+        DisplayTransfer           = 0x00300, // + 301,302,303,304,305,306
+
+        CommandProcessor          = 0x00638, // + 63a,63c
+
+        NumIds                    = 0x01000
+    };
+
+    template<Id id>
+    struct Struct;
+
+    enum class FramebufferFormat : u32 {
+        RGBA8  = 0,
+        RGB8   = 1,
+        RGB565 = 2,
+        RGB5A1 = 3,
+        RGBA4  = 4,
+    };
+};
+
+template<>
+struct Regs::Struct<Regs::MemoryFill> {
+    u32 address_start;
+    u32 address_end; // ?
+    u32 size;
+    u32 value; // ?
+
+    inline u32 GetStartAddress() const {
+        return address_start * 8;
+    }
+
+    inline u32 GetEndAddress() const {
+        return address_end * 8;
+    }
+};
+static_assert(sizeof(Regs::Struct<Regs::MemoryFill>) == 0x10, "Structure size and register block length don't match");
+
+template<>
+struct Regs::Struct<Regs::FramebufferTop> {
+    using Format = Regs::FramebufferFormat;
+
+    union {
+        u32 size;
+
+        BitField< 0, 16, u32> width;
+        BitField<16, 16, u32> height;
+    };
+
+    u32 pad0[2];
+
+    u32 address_left1;
+    u32 address_left2;
+
+    union {
+        u32 format;
+
+        BitField< 0, 3, Format> color_format;
+    };
+
+    u32 pad1;
+
+    union {
+        u32 active_fb;
+
+        // 0: Use parameters ending with "1"
+        // 1: Use parameters ending with "2"
+        BitField<0, 1, u32> second_fb_active;
+    };
+
+    u32 pad2[5];
+
+    // Distance between two pixel rows, in bytes
+    u32 stride;
+
+    u32 address_right1;
+    u32 address_right2;
+};
+
+template<>
+struct Regs::Struct<Regs::FramebufferBottom> : public Regs::Struct<Regs::FramebufferTop> {
+};
+static_assert(sizeof(Regs::Struct<Regs::FramebufferTop>) == 0x40, "Structure size and register block length don't match");
+
+template<>
+struct Regs::Struct<Regs::DisplayTransfer> {
+    using Format = Regs::FramebufferFormat;
+
+    u32 input_address;
+    u32 output_address;
+
+    inline u32 GetPhysicalInputAddress() const {
+        return input_address * 8;
+    }
+
+    inline u32 GetPhysicalOutputAddress() const {
+        return output_address * 8;
+    }
+
+    union {
+        u32 output_size;
+
+        BitField< 0, 16, u32> output_width;
+        BitField<16, 16, u32> output_height;
+    };
+
+    union {
+        u32 input_size;
+
+        BitField< 0, 16, u32> input_width;
+        BitField<16, 16, u32> input_height;
     };
 
-    u32 framebuffer_top_left_1;
-    u32 framebuffer_top_left_2;
-    u32 framebuffer_top_right_1;
-    u32 framebuffer_top_right_2;
-    u32 framebuffer_sub_left_1;
-    u32 framebuffer_sub_left_2;
-    u32 framebuffer_sub_right_1;
-    u32 framebuffer_sub_right_2;
-
-    u32 command_list_size;
-    u32 command_list_address;
-    u32 command_processing_enabled;
+    union {
+        u32 flags;
+
+        BitField< 0, 1, u32> flip_data;        // flips input data horizontally (TODO) if true
+        BitField< 8, 3, Format> input_format;
+        BitField<12, 3, Format> output_format;
+        BitField<16, 1, u32> output_tiled;     // stores output in a tiled format
+    };
+
+    u32 unknown;
+
+    // it seems that writing to this field triggers the display transfer
+    u32 trigger;
 };
+static_assert(sizeof(Regs::Struct<Regs::DisplayTransfer>) == 0x1C, "Structure size and register block length don't match");
+
+template<>
+struct Regs::Struct<Regs::CommandProcessor> {
+    // command list size
+    u32 size;
+
+    u32 pad0;
+
+    // command list address
+    u32 address;
 
-extern Registers g_regs;
+    u32 pad1;
+
+    // it seems that writing to this field triggers command list processing
+    u32 trigger;
+};
+static_assert(sizeof(Regs::Struct<Regs::CommandProcessor>) == 0x14, "Structure size and register block length don't match");
+
+
+extern RegisterSet<u32, Regs> g_regs;
 
 enum {
     TOP_ASPECT_X        = 0x5,
@@ -51,23 +176,35 @@ enum {
     TOP_WIDTH           = 400,
     BOTTOM_WIDTH        = 320,
 
-    // Physical addresses in FCRAM used by ARM9 applications - these are correct for real hardware 
-    PADDR_FRAMEBUFFER_SEL       = 0x20184E59,
-    PADDR_TOP_LEFT_FRAME1       = 0x20184E60,
+    // Physical addresses in FCRAM (chosen arbitrarily)
+    PADDR_TOP_LEFT_FRAME1       = 0x201D4C00,
+    PADDR_TOP_LEFT_FRAME2       = 0x202D4C00,
+    PADDR_TOP_RIGHT_FRAME1      = 0x203D4C00,
+    PADDR_TOP_RIGHT_FRAME2      = 0x204D4C00,
+    PADDR_SUB_FRAME1            = 0x205D4C00,
+    PADDR_SUB_FRAME2            = 0x206D4C00,
+    // Physical addresses in FCRAM used by ARM9 applications
+/*    PADDR_TOP_LEFT_FRAME1       = 0x20184E60,
     PADDR_TOP_LEFT_FRAME2       = 0x201CB370,
     PADDR_TOP_RIGHT_FRAME1      = 0x20282160,
     PADDR_TOP_RIGHT_FRAME2      = 0x202C8670,
     PADDR_SUB_FRAME1            = 0x202118E0,
-    PADDR_SUB_FRAME2            = 0x20249CF0,
-
-    // Physical addresses in VRAM - I'm not sure how these are actually allocated (so not real)
-    PADDR_VRAM_FRAMEBUFFER_SEL  = 0x18184E59,
-    PADDR_VRAM_TOP_LEFT_FRAME1  = 0x18184E60,
-    PADDR_VRAM_TOP_LEFT_FRAME2  = 0x181CB370,
+    PADDR_SUB_FRAME2            = 0x20249CF0,*/
+
+    // Physical addresses in VRAM
+    // TODO: These should just be deduced from the ones above
+    PADDR_VRAM_TOP_LEFT_FRAME1  = 0x181D4C00,
+    PADDR_VRAM_TOP_LEFT_FRAME2  = 0x182D4C00,
+    PADDR_VRAM_TOP_RIGHT_FRAME1 = 0x183D4C00,
+    PADDR_VRAM_TOP_RIGHT_FRAME2 = 0x184D4C00,
+    PADDR_VRAM_SUB_FRAME1       = 0x185D4C00,
+    PADDR_VRAM_SUB_FRAME2       = 0x186D4C00,
+    // Physical addresses in VRAM used by ARM9 applications
+/*    PADDR_VRAM_TOP_LEFT_FRAME2  = 0x181CB370,
     PADDR_VRAM_TOP_RIGHT_FRAME1 = 0x18282160,
     PADDR_VRAM_TOP_RIGHT_FRAME2 = 0x182C8670,
     PADDR_VRAM_SUB_FRAME1       = 0x182118E0,
-    PADDR_VRAM_SUB_FRAME2       = 0x18249CF0,
+    PADDR_VRAM_SUB_FRAME2       = 0x18249CF0,*/
 };
 
 /// Framebuffer location
@@ -79,7 +216,7 @@ enum FramebufferLocation {
 
 /**
  * Sets whether the framebuffers are in the GSP heap (FCRAM) or VRAM
- * @param 
+ * @param
  */
 void SetFramebufferLocation(const FramebufferLocation mode);
 
@@ -90,16 +227,18 @@ void SetFramebufferLocation(const FramebufferLocation mode);
  */
 const u8* GetFramebufferPointer(const u32 address);
 
+u32 GetFramebufferAddr(const u32 address);
+
 /**
  * Gets the location of the framebuffers
  */
-const FramebufferLocation GetFramebufferLocation();
+FramebufferLocation GetFramebufferLocation(u32 address);
 
 template <typename T>
-inline void Read(T &var, const u32 addr);
+void Read(T &var, const u32 addr);
 
 template <typename T>
-inline void Write(u32 addr, const T data);
+void Write(u32 addr, const T data);
 
 /// Update hardware
 void Update();
diff --git a/src/core/hw/hw.h b/src/core/hw/hw.h
index 92e9304ca..1055ed94f 100644
--- a/src/core/hw/hw.h
+++ b/src/core/hw/hw.h
@@ -9,10 +9,10 @@
 namespace HW {
 
 template <typename T>
-inline void Read(T &var, const u32 addr);
+void Read(T &var, const u32 addr);
 
 template <typename T>
-inline void Write(u32 addr, const T data);
+void Write(u32 addr, const T data);
 
 /// Update hardware
 void Update();