From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055170633984.8346474749047; Fri, 20 Mar 2026 18:06:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klV-0008Pe-F2; Fri, 20 Mar 2026 21:04:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klU-0008P4-IQ for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:32 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klR-0003yL-BL for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:32 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 86B03596E00; Sat, 21 Mar 2026 02:04:23 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id c19mO70v-B_g; Sat, 21 Mar 2026 02:04:19 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 11A1D5969F3; Sat, 21 Mar 2026 02:04:19 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <759ed5e3b019cce94e9a4ef003f1fc2e0cea2ec1.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 1/8] ati-vga: Fix colors when frame buffer endianness does not match host MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:19 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055173220158500 Content-Type: text/plain; charset="utf-8" When writing pixels we have to take into account if the frame buffer endianness matches the host endianness or we need to swap to correct endianness. This caused wrong colors e.g. with PPC Linux guest that uses big endian frame buffer when running on little endian host. Signed-off-by: BALATON Zoltan Tested-by: Chad Jablonski Reviewed-by: Chad Jablonski --- hw/display/ati_2d.c | 40 +++++++++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 11 deletions(-) diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 37fe6c17ee..0cbbdc33f4 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -50,6 +50,7 @@ typedef struct { bool host_data_active; bool left_to_right; bool top_to_bottom; + bool need_swap; uint32_t frgd_clr; const uint8_t *palette; const uint8_t *vram_end; @@ -89,6 +90,7 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DC= tx *ctx) ctx->host_data_active =3D s->host_data.active; ctx->left_to_right =3D s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT; ctx->top_to_bottom =3D s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM; + ctx->need_swap =3D HOST_BIG_ENDIAN !=3D s->vga.big_endian_fb ? true : = false; ctx->frgd_clr =3D s->regs.dp_brush_frgd_clr; ctx->palette =3D s->vga.palette; ctx->dst_offset =3D s->regs.dst_offset; @@ -131,6 +133,17 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI= 2DCtx *ctx) (ctx->top_to_bottom ? 'v' : '^')); } =20 +static uint32_t make_filler(int bpp, uint32_t color) +{ + if (bpp < 24) { + color |=3D color << 16; + if (bpp < 15) { + color |=3D color << 8; + } + } + return color; +} + static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman) { QemuRect vis_src, vis_dst; @@ -255,7 +268,7 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pi= xman) =20 switch (ctx->rop3) { case ROP3_PATCOPY: - filler =3D ctx->frgd_clr; + filler =3D make_filler(ctx->bpp, ctx->frgd_clr); break; case ROP3_BLACKNESS: filler =3D 0xffUL << 24 | rgb_to_pixel32(ctx->palette[0], @@ -268,10 +281,12 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_= pixman) ctx->palette[5]); break; } - DPRINTF("pixman_fill(%p, %ld, %d, %d, %d, %d, %d, %x)\n", ctx->dst_bits, ctx->dst_stride / sizeof(uint32_t), ctx->bp= p, vis_dst.x, vis_dst.y, vis_dst.width, vis_dst.height, fille= r); + if (ctx->need_swap) { + bswap32s(&filler); + } #ifdef CONFIG_PIXMAN if (!(use_pixman & BIT(0)) || !pixman_fill((uint32_t *)ctx->dst_bits, @@ -325,11 +340,8 @@ void ati_2d_blt(ATIVGAState *s) bool ati_host_data_flush(ATIVGAState *s) { ATI2DCtx ctx, chunk; - uint32_t fg =3D s->regs.dp_src_frgd_clr; - uint32_t bg =3D s->regs.dp_src_bkgd_clr; unsigned bypp, pix_count, row, col, idx; uint8_t pix_buf[ATI_HOST_DATA_ACC_BITS * sizeof(uint32_t)]; - uint32_t byte_pix_order =3D s->regs.dp_datatype & DP_BYTE_PIX_ORDER; uint32_t src_source =3D s->regs.dp_mix & DP_SRC_SOURCE; uint32_t src_datatype =3D s->regs.dp_datatype & DP_SRC_DATATYPE; =20 @@ -360,21 +372,27 @@ bool ati_host_data_flush(ATIVGAState *s) } =20 bypp =3D ctx.bpp / 8; - + pix_count =3D ATI_HOST_DATA_ACC_BITS; if (src_datatype =3D=3D SRC_COLOR) { - pix_count =3D ATI_HOST_DATA_ACC_BITS / ctx.bpp; - memcpy(pix_buf, &s->host_data.acc[0], sizeof(s->host_data.acc)); + pix_count /=3D ctx.bpp; + memcpy(pix_buf, s->host_data.acc, sizeof(s->host_data.acc)); } else { - pix_count =3D ATI_HOST_DATA_ACC_BITS; /* Expand monochrome bits to color pixels */ + uint32_t byte_pix_order =3D s->regs.dp_datatype & DP_BYTE_PIX_ORDE= R; + uint32_t fg =3D make_filler(ctx.bpp, s->regs.dp_src_frgd_clr); + uint32_t bg =3D make_filler(ctx.bpp, s->regs.dp_src_bkgd_clr); + + if (ctx.need_swap) { + bswap32s(&fg); + bswap32s(&bg); + } idx =3D 0; for (int word =3D 0; word < 4; word++) { for (int byte =3D 0; byte < 4; byte++) { uint8_t byte_val =3D s->host_data.acc[word] >> (byte * 8); for (int i =3D 0; i < 8; i++) { bool is_fg =3D byte_val & BIT(byte_pix_order ? i : 7 -= i); - uint32_t color =3D is_fg ? fg : bg; - stn_he_p(&pix_buf[idx], bypp, color); + stn_he_p(&pix_buf[idx], bypp, is_fg ? fg : bg); idx +=3D bypp; } } --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055172782341.67354715740134; Fri, 20 Mar 2026 18:06:12 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klV-0008Pg-Ts; Fri, 20 Mar 2026 21:04:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klU-0008P1-FI for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:32 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klR-0003yJ-2T for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:32 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 29490596D90; Sat, 21 Mar 2026 02:04:23 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id HtiE5IqziNky; Sat, 21 Mar 2026 02:04:20 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 2870F596A4E; Sat, 21 Mar 2026 02:04:20 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 2/8] ati-vga: Also switch mode on HW cursor enable bit change MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:20 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055173720154100 Content-Type: text/plain; charset="utf-8" This does nothing for most drivers but works around issue and fixes output with the Solaris R128 driver that only sets display parameters after enabling CRT controller which we would miss otherwise. Signed-off-by: BALATON Zoltan Tested-by: Chad Jablonski Reviewed-by: Chad Jablonski --- hw/display/ati.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/ati.c b/hw/display/ati.c index c165434938..8286f67c1c 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -632,6 +632,7 @@ static void ati_mm_write(void *opaque, hwaddr addr, ati_reg_write_offs(&s->regs.crtc_gen_cntl, addr - CRTC_GEN_CNTL, data, size); if ((val & CRTC2_CUR_EN) !=3D (s->regs.crtc_gen_cntl & CRTC2_CUR_E= N)) { + ati_vga_switch_mode(s); if (s->cursor_guest_mode) { s->vga.force_shadow =3D !!(s->regs.crtc_gen_cntl & CRTC2_C= UR_EN); } else { --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055132432287.392286924514; Fri, 20 Mar 2026 18:05:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klY-0008Qw-En; Fri, 20 Mar 2026 21:04:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klX-0008QU-31 for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:35 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klU-0003zF-BG for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:34 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 8BE3E596E12; Sat, 21 Mar 2026 02:04:28 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id BTIs0gQuyUnB; Sat, 21 Mar 2026 02:04:23 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 416A3596A4F; Sat, 21 Mar 2026 02:04:21 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <7d96c67f864845893d4903b988a4da7c7b010f66.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 3/8] ati-vga: Do not add crtc offset to src and dst data address MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:21 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055135312154100 Content-Type: text/plain; charset="utf-8" Drivers seem to program these registers with values that already include the crtc offset so this is not needed. This fixes blit outside of vram errors with non-0 crtc offset. Signed-off-by: BALATON Zoltan Reviewed-by: Chad Jablonski --- hw/display/ati_2d.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 0cbbdc33f4..cf2d4a08e2 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -110,7 +110,6 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2= DCtx *ctx) ctx->dst_stride =3D s->regs.dst_pitch; ctx->dst_bits =3D s->vga.vram_ptr + s->regs.dst_offset; if (s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF) { - ctx->dst_bits +=3D s->regs.crtc_offset & 0x07ffffff; ctx->dst_stride *=3D ctx->bpp; } =20 @@ -121,7 +120,6 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2= DCtx *ctx) ctx->src_stride =3D s->regs.src_pitch; ctx->src_bits =3D s->vga.vram_ptr + s->regs.src_offset; if (s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF) { - ctx->src_bits +=3D s->regs.crtc_offset & 0x07ffffff; ctx->src_stride *=3D ctx->bpp; } DPRINTF("%d %d %d, %d %d %d, (%d,%d) -> (%d,%d) %dx%d %c %c\n", --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055138144194.29936555494305; Fri, 20 Mar 2026 18:05:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klY-0008Qq-Ec; Fri, 20 Mar 2026 21:04:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klX-0008QS-0f for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:35 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klU-0003zG-B5 for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:33 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id A3049596E16; Sat, 21 Mar 2026 02:04:28 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id RBagj9XHgyEA; Sat, 21 Mar 2026 02:04:23 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 583F8596D8F; Sat, 21 Mar 2026 02:04:22 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <9a3263a06bc72aa5a56bafe0a11ad189d5f60528.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 4/8] ati-vga: Avoid warnings about sign extension MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:22 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055140956154100 Content-Type: text/plain; charset="utf-8" Coverity reports several possible sign extension errors (latest is CID 1645615). These cannot happen because the values are limited when writing the registers and only 32 bits of the return value matter but change type of the variable storing the return value to uint32_t to avoid these warnings. Also change DEFAULT_SC_BOTTOM_RIGHT register read to match what other similar registers do for consistency. Signed-off-by: BALATON Zoltan Reviewed-by: Peter Maydell --- hw/display/ati.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 8286f67c1c..705e4db6e4 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -266,7 +266,7 @@ static void ati_vga_vblank_irq(void *opaque) ati_vga_update_irq(s); } =20 -static inline uint64_t ati_reg_read_offs(uint32_t reg, int offs, +static inline uint32_t ati_reg_read_offs(uint32_t reg, int offs, unsigned int size) { if (offs =3D=3D 0 && size =3D=3D 4) { @@ -279,7 +279,7 @@ static inline uint64_t ati_reg_read_offs(uint32_t reg, = int offs, static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size) { ATIVGAState *s =3D opaque; - uint64_t val =3D 0; + uint32_t val =3D 0; =20 switch (addr) { case MM_INDEX: @@ -514,8 +514,8 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, = unsigned int size) val |=3D s->regs.default_tile << 16; break; case DEFAULT_SC_BOTTOM_RIGHT: - val =3D (s->regs.default_sc_bottom << 16) | - s->regs.default_sc_right; + val =3D s->regs.default_sc_right; + val |=3D s->regs.default_sc_bottom << 16; break; case SC_TOP: val =3D s->regs.sc_top; --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177405512693196.75362051845786; Fri, 20 Mar 2026 18:05:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klV-0008P0-1j; Fri, 20 Mar 2026 21:04:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klT-0008OU-4L for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:31 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klR-0003yY-2p for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:30 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id A9C99596E0E; Sat, 21 Mar 2026 02:04:26 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id EIY6_Rp0i2Fw; Sat, 21 Mar 2026 02:04:23 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 63009596DFE; Sat, 21 Mar 2026 02:04:23 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <6e1b83ef3fe7a1ebc246b474eb2b0c7cd05d5deb.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 5/8] ati-vga: Fix display updates in non-32 bit modes MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:23 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055129066154100 Content-Type: text/plain; charset="utf-8" The memory_region_set_dirty used to mark changes should use stride value in vram which is normally only the same as surface_stride in 32 bit modes. This caused missed updates in 8 and 16 bit modes. Signed-off-by: BALATON Zoltan Reviewed-by: Chad Jablonski --- hw/display/ati_2d.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index cf2d4a08e2..23527b2c50 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -70,6 +70,7 @@ static void ati_set_dirty(VGACommonState *vga, const ATI2= DCtx *ctx) { DisplaySurface *ds =3D qemu_console_surface(vga->con); =20 + (void)ds; DPRINTF("%p %u ds: %p %d %d rop: %x\n", vga->vram_ptr, vga->vbe_start_= addr, surface_data(ds), surface_stride(ds), surface_bits_per_pixel(d= s), ctx->rop3 >> 16); @@ -78,8 +79,8 @@ static void ati_set_dirty(VGACommonState *vga, const ATI2= DCtx *ctx) vga->vbe_regs[VBE_DISPI_INDEX_YRES] * vga->vbe_line_offset) { memory_region_set_dirty(&vga->vram, vga->vbe_start_addr + ctx->dst_offset + - ctx->dst.y * surface_stride(ds), - ctx->dst.height * surface_stride(ds)); + ctx->dst.y * ctx->dst_stride, + ctx->dst.height * ctx->dst_stride); } } =20 --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055116948937.9047375686848; Fri, 20 Mar 2026 18:05:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klW-0008Pz-AZ; Fri, 20 Mar 2026 21:04:34 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klU-0008P2-HM for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:32 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klS-0003yp-Kp for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:32 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 29867596E10; Sat, 21 Mar 2026 02:04:28 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id BrX63-gHpfhZ; Sat, 21 Mar 2026 02:04:26 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 7C44B596E02; Sat, 21 Mar 2026 02:04:24 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <47cbdc7ad2291f22467f9fc86e7287eb8983c927.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 6/8] ati-vga: Add work around for fuloong2e MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:24 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055123056154100 Content-Type: text/plain; charset="utf-8" With the linear aperture size fixed to match real card fuloong2e no longer works due to running out of PCI memory because only one PCI bus is emulated on that machine. Add a property to allow fuloong2e to set a smaller linear aperture size to work around that problem until the machine model is improved. Signed-off-by: BALATON Zoltan Reviewed-by: Chad Jablonski --- hw/display/ati.c | 17 +++++++++++++---- hw/display/ati_int.h | 1 + hw/mips/fuloong2e.c | 1 + 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 705e4db6e4..fba73a9956 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -1074,7 +1074,6 @@ static void ati_vga_realize(PCIDevice *dev, Error **e= rrp) ATIVGAState *s =3D ATI_VGA(dev); VGACommonState *vga =3D &s->vga; I2CBus *i2cbus; - uint64_t aper_size; =20 #ifndef CONFIG_PIXMAN if (s->use_pixman !=3D 0) { @@ -1138,10 +1137,19 @@ static void ati_vga_realize(PCIDevice *dev, Error *= *errp) * Rage128 the upper half of the aperture is reserved for an AGP * window (which we do not emulate.) */ - aper_size =3D s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF ? - ATI_RAGE128_LINEAR_APER_SIZE : ATI_R100_LINEAR_APER_SIZE; + if (!s->linear_aper_sz) { + if (s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF) { + s->linear_aper_sz =3D ATI_RAGE128_LINEAR_APER_SIZE; + } else { + s->linear_aper_sz =3D ATI_R100_LINEAR_APER_SIZE; + } + } + if (s->linear_aper_sz < 16 * MiB) { + error_setg(errp, "x-linear-aper-size is too small (minimum 16 MiB)= "); + return; + } memory_region_init(&s->linear_aper, OBJECT(dev), "ati-linear-aperture0= ", - aper_size); + s->linear_aper_sz); memory_region_add_subregion(&s->linear_aper, 0, &vga->vram); =20 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->linear_ape= r); @@ -1186,6 +1194,7 @@ static const Property ati_vga_properties[] =3D { DEFINE_PROP_BOOL("guest_hwcursor", ATIVGAState, cursor_guest_mode, fal= se), /* this is a debug option, prefer PROP_UINT over PROP_BIT for simplici= ty */ DEFINE_PROP_UINT8("x-pixman", ATIVGAState, use_pixman, DEFAULT_X_PIXMA= N), + DEFINE_PROP_UINT64("x-linear-aper-size", ATIVGAState, linear_aper_sz, = 0), DEFINE_EDID_PROPERTIES(ATIVGAState, i2cddc.edid_info), }; =20 diff --git a/hw/display/ati_int.h b/hw/display/ati_int.h index 21b74511e0..0c48934d33 100644 --- a/hw/display/ati_int.h +++ b/hw/display/ati_int.h @@ -119,6 +119,7 @@ struct ATIVGAState { QEMUTimer vblank_timer; bitbang_i2c_interface bbi2c; I2CDDCState i2cddc; + uint64_t linear_aper_sz; MemoryRegion linear_aper; MemoryRegion io; MemoryRegion mm; diff --git a/hw/mips/fuloong2e.c b/hw/mips/fuloong2e.c index d0efe36f7c..72ad4507df 100644 --- a/hw/mips/fuloong2e.c +++ b/hw/mips/fuloong2e.c @@ -316,6 +316,7 @@ static void mips_fuloong2e_init(MachineState *machine) dev =3D DEVICE(pci_dev); qdev_prop_set_uint32(dev, "vgamem_mb", 16); qdev_prop_set_uint16(dev, "x-device-id", 0x5159); + qdev_prop_set_uint64(dev, "x-linear-aper-size", 16 * MiB); pci_realize_and_unref(pci_dev, pci_bus, &error_fatal); } =20 --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055116489206.236724087271; Fri, 20 Mar 2026 18:05:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klY-0008RI-Vd; Fri, 20 Mar 2026 21:04:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klX-0008QT-0u for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:35 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klU-0003zM-Ez for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:34 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 36881596E02; Sat, 21 Mar 2026 02:04:30 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id 04Wgy9woiyOc; Sat, 21 Mar 2026 02:04:28 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 8F368596E06; Sat, 21 Mar 2026 02:04:25 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <306212035766ca9459c6c8e890135d361bb5d491.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 7/8] ati-vga: Fix mouse pointer on big endian frame buffer MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:25 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055122895154101 Content-Type: text/plain; charset="utf-8" Rewrite reading of mouse pointer image to fix broken mouse cursor with big endian frame buffer. I am not sure this is entirely correct but appears to work at least on little endian host with PPC guests using little or big endian frame buffer. Signed-off-by: BALATON Zoltan --- hw/display/ati.c | 63 +++++++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index fba73a9956..c278d11d34 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -142,27 +142,29 @@ static void ati_vga_switch_mode(ATIVGAState *s) /* Used by host side hardware cursor */ static void ati_cursor_define(ATIVGAState *s) { - uint8_t data[1024]; + uint64_t data[128]; uint32_t srcoff; - int i, j, idx =3D 0; =20 if ((s->regs.cur_offset & BIT(31)) || s->cursor_guest_mode) { return; /* Do not update cursor if locked or rendered by guest */ } /* FIXME handle cur_hv_offs correctly */ - srcoff =3D s->regs.cur_offset - - (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; - for (i =3D 0; i < 64; i++) { - for (j =3D 0; j < 8; j++, idx++) { - data[idx] =3D vga_read_byte(&s->vga, srcoff + i * 16 + j); - data[512 + idx] =3D vga_read_byte(&s->vga, srcoff + i * 16 + j= + 8); + srcoff =3D s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - + (s->regs.cur_hv_offs & 0xffff) * 16; + for (int i =3D 0; i < 64; i++, srcoff +=3D 16) { + if (s->vga.big_endian_fb) { + data[i] =3D wswap64(ldq_be_p(&s->vga.vram_ptr[srcoff])); + data[i + 64] =3D wswap64(ldq_be_p(&s->vga.vram_ptr[srcoff + 8]= )); + } else { + data[i] =3D ldq_le_p(&s->vga.vram_ptr[srcoff]); + data[i + 64] =3D ldq_le_p(&s->vga.vram_ptr[srcoff + 8]); } } if (!s->cursor) { s->cursor =3D cursor_alloc(64, 64); } cursor_set_mono(s->cursor, s->regs.cur_color1, s->regs.cur_color0, - &data[512], 1, &data[0]); + (uint8_t *)&data[64], 1, (uint8_t *)&data[0]); dpy_cursor_define(s->vga.con, s->cursor); } =20 @@ -197,9 +199,9 @@ static void ati_cursor_invalidate(VGACommonState *vga) static void ati_cursor_draw_line(VGACommonState *vga, uint8_t *d, int scr_= y) { ATIVGAState *s =3D container_of(vga, ATIVGAState, vga); - uint32_t srcoff; + uint32_t h, srcoff, color; + uint64_t abits, xbits, mask; uint32_t *dp =3D (uint32_t *)d; - int i, j, h, idx =3D 0; =20 if (!(s->regs.crtc_gen_cntl & CRTC2_CUR_EN) || scr_y < vga->hw_cursor_y || scr_y >=3D vga->hw_cursor_y + 64 || @@ -210,26 +212,31 @@ static void ati_cursor_draw_line(VGACommonState *vga,= uint8_t *d, int scr_y) srcoff =3D s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16; dp =3D &dp[vga->hw_cursor_x]; h =3D ((s->regs.crtc_h_total_disp >> 16) + 1) * 8; - for (i =3D 0; i < 8; i++) { - uint32_t color; - uint8_t abits =3D vga_read_byte(vga, srcoff + i); - uint8_t xbits =3D vga_read_byte(vga, srcoff + i + 8); - for (j =3D 0; j < 8; j++, abits <<=3D 1, xbits <<=3D 1, idx++) { - if (vga->hw_cursor_x + idx >=3D h) { - return; /* end of screen, don't span to next line */ - } - if (abits & BIT(7)) { - if (xbits & BIT(7)) { - color =3D dp[idx] ^ 0xffffffff; /* complement */ - } else { - continue; /* transparent, no change */ - } + abits =3D ldq_le_p(&vga->vram_ptr[srcoff]); + xbits =3D ldq_le_p(&vga->vram_ptr[srcoff + 8]); + if (vga->big_endian_fb) { + abits =3D wswap64(abits); + xbits =3D wswap64(xbits); + } else { + bswap64s(&abits); + bswap64s(&xbits); + } + mask =3D BIT(63); + for (int i =3D 0; i < 64; i++, mask >>=3D 1) { + if (vga->hw_cursor_x + i >=3D h) { + return; /* end of screen, don't span to next line */ + } + if (abits & mask) { + if (xbits & mask) { + color =3D dp[i] ^ 0xffffffff; /* complement */ } else { - color =3D (xbits & BIT(7) ? s->regs.cur_color1 : - s->regs.cur_color0) | 0xff000000; + continue; /* transparent, no change */ } - dp[idx] =3D color; + } else { + color =3D (xbits & mask ? s->regs.cur_color1 : + s->regs.cur_color0) | 0xff000000; } + dp[i] =3D color; } } =20 --=20 2.41.3 From nobody Sun Mar 22 14:09:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774055122048158.53675106469348; Fri, 20 Mar 2026 18:05:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3klZ-0008Rp-Vw; Fri, 20 Mar 2026 21:04:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klY-0008RF-UN for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:36 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3klX-0003zy-CN for qemu-devel@nongnu.org; Fri, 20 Mar 2026 21:04:36 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id D331E596E8E; Sat, 21 Mar 2026 02:04:33 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id OthSGY-W20f1; Sat, 21 Mar 2026 02:04:28 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 9A56A596E0C; Sat, 21 Mar 2026 02:04:26 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <671a065693316a8e5a330dce2c10c6b1370f4649.1774054635.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v5 8/8] ati-vga: Make sure hardware cursor data is within vram MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 02:04:26 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774055125082154100 Content-Type: text/plain; charset="utf-8" Add check to make sure we don't read past the end of vram when getting mouse pointer image. Signed-off-by: BALATON Zoltan --- hw/display/ati.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/display/ati.c b/hw/display/ati.c index c278d11d34..12ef180828 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -151,6 +151,9 @@ static void ati_cursor_define(ATIVGAState *s) /* FIXME handle cur_hv_offs correctly */ srcoff =3D s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; + if (srcoff + 64 * 16 > s->vga.vram_size) { + return; + } for (int i =3D 0; i < 64; i++, srcoff +=3D 16) { if (s->vga.big_endian_fb) { data[i] =3D wswap64(ldq_be_p(&s->vga.vram_ptr[srcoff])); @@ -210,6 +213,9 @@ static void ati_cursor_draw_line(VGACommonState *vga, u= int8_t *d, int scr_y) } /* FIXME handle cur_hv_offs correctly */ srcoff =3D s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16; + if (srcoff + 16 > s->vga.vram_size) { + return; + } dp =3D &dp[vga->hw_cursor_x]; h =3D ((s->regs.crtc_h_total_disp >> 16) + 1) * 8; abits =3D ldq_le_p(&vga->vram_ptr[srcoff]); --=20 2.41.3