From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774110677778424.4335495926217; Sat, 21 Mar 2026 09:31:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDe-0006Ca-An; Sat, 21 Mar 2026 12:30:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDR-00064s-Nl for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:25 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDN-0002DM-Ks for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:20 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 11AF3596A4B; Sat, 21 Mar 2026 17:30:14 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id yDXoSygmyMff; Sat, 21 Mar 2026 17:30:11 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id D3615596A4A; Sat, 21 Mar 2026 17:30:11 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <759ed5e3b019cce94e9a4ef003f1fc2e0cea2ec1.1774110169.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 1/8] ati-vga: Fix colors when frame buffer endianness does not match host MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:11 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110683239154100 Content-Type: text/plain; charset="utf-8" When writing pixels we have to take into account if the frame buffer endianness matches the host endianness or we need to swap to correct endianness. This caused wrong colors e.g. with PPC Linux guest that uses big endian frame buffer when running on little endian host. Signed-off-by: BALATON Zoltan Tested-by: Chad Jablonski Reviewed-by: Chad Jablonski --- hw/display/ati_2d.c | 40 +++++++++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 11 deletions(-) diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 37fe6c17ee..0cbbdc33f4 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -50,6 +50,7 @@ typedef struct { bool host_data_active; bool left_to_right; bool top_to_bottom; + bool need_swap; uint32_t frgd_clr; const uint8_t *palette; const uint8_t *vram_end; @@ -89,6 +90,7 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DC= tx *ctx) ctx->host_data_active =3D s->host_data.active; ctx->left_to_right =3D s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT; ctx->top_to_bottom =3D s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM; + ctx->need_swap =3D HOST_BIG_ENDIAN !=3D s->vga.big_endian_fb ? true : = false; ctx->frgd_clr =3D s->regs.dp_brush_frgd_clr; ctx->palette =3D s->vga.palette; ctx->dst_offset =3D s->regs.dst_offset; @@ -131,6 +133,17 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI= 2DCtx *ctx) (ctx->top_to_bottom ? 'v' : '^')); } =20 +static uint32_t make_filler(int bpp, uint32_t color) +{ + if (bpp < 24) { + color |=3D color << 16; + if (bpp < 15) { + color |=3D color << 8; + } + } + return color; +} + static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pixman) { QemuRect vis_src, vis_dst; @@ -255,7 +268,7 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_pi= xman) =20 switch (ctx->rop3) { case ROP3_PATCOPY: - filler =3D ctx->frgd_clr; + filler =3D make_filler(ctx->bpp, ctx->frgd_clr); break; case ROP3_BLACKNESS: filler =3D 0xffUL << 24 | rgb_to_pixel32(ctx->palette[0], @@ -268,10 +281,12 @@ static bool ati_2d_do_blt(ATI2DCtx *ctx, uint8_t use_= pixman) ctx->palette[5]); break; } - DPRINTF("pixman_fill(%p, %ld, %d, %d, %d, %d, %d, %x)\n", ctx->dst_bits, ctx->dst_stride / sizeof(uint32_t), ctx->bp= p, vis_dst.x, vis_dst.y, vis_dst.width, vis_dst.height, fille= r); + if (ctx->need_swap) { + bswap32s(&filler); + } #ifdef CONFIG_PIXMAN if (!(use_pixman & BIT(0)) || !pixman_fill((uint32_t *)ctx->dst_bits, @@ -325,11 +340,8 @@ void ati_2d_blt(ATIVGAState *s) bool ati_host_data_flush(ATIVGAState *s) { ATI2DCtx ctx, chunk; - uint32_t fg =3D s->regs.dp_src_frgd_clr; - uint32_t bg =3D s->regs.dp_src_bkgd_clr; unsigned bypp, pix_count, row, col, idx; uint8_t pix_buf[ATI_HOST_DATA_ACC_BITS * sizeof(uint32_t)]; - uint32_t byte_pix_order =3D s->regs.dp_datatype & DP_BYTE_PIX_ORDER; uint32_t src_source =3D s->regs.dp_mix & DP_SRC_SOURCE; uint32_t src_datatype =3D s->regs.dp_datatype & DP_SRC_DATATYPE; =20 @@ -360,21 +372,27 @@ bool ati_host_data_flush(ATIVGAState *s) } =20 bypp =3D ctx.bpp / 8; - + pix_count =3D ATI_HOST_DATA_ACC_BITS; if (src_datatype =3D=3D SRC_COLOR) { - pix_count =3D ATI_HOST_DATA_ACC_BITS / ctx.bpp; - memcpy(pix_buf, &s->host_data.acc[0], sizeof(s->host_data.acc)); + pix_count /=3D ctx.bpp; + memcpy(pix_buf, s->host_data.acc, sizeof(s->host_data.acc)); } else { - pix_count =3D ATI_HOST_DATA_ACC_BITS; /* Expand monochrome bits to color pixels */ + uint32_t byte_pix_order =3D s->regs.dp_datatype & DP_BYTE_PIX_ORDE= R; + uint32_t fg =3D make_filler(ctx.bpp, s->regs.dp_src_frgd_clr); + uint32_t bg =3D make_filler(ctx.bpp, s->regs.dp_src_bkgd_clr); + + if (ctx.need_swap) { + bswap32s(&fg); + bswap32s(&bg); + } idx =3D 0; for (int word =3D 0; word < 4; word++) { for (int byte =3D 0; byte < 4; byte++) { uint8_t byte_val =3D s->host_data.acc[word] >> (byte * 8); for (int i =3D 0; i < 8; i++) { bool is_fg =3D byte_val & BIT(byte_pix_order ? i : 7 -= i); - uint32_t color =3D is_fg ? fg : bg; - stn_he_p(&pix_buf[idx], bypp, color); + stn_he_p(&pix_buf[idx], bypp, is_fg ? fg : bg); idx +=3D bypp; } } --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774110717290802.8952814967475; Sat, 21 Mar 2026 09:31:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDg-0006Cf-7n; Sat, 21 Mar 2026 12:30:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDR-00064p-Lo for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:25 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDN-0002Db-LP for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:20 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id EC11D596A4E; Sat, 21 Mar 2026 17:30:14 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id I9QWYlZhTsVz; Sat, 21 Mar 2026 17:30:12 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id E4F2F5969E4; Sat, 21 Mar 2026 17:30:12 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 2/8] ati-vga: Also switch mode on HW cursor enable bit change MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:12 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110719875154100 Content-Type: text/plain; charset="utf-8" This does nothing for most drivers but works around issue and fixes output with the Solaris R128 driver that only sets display parameters after enabling CRT controller which we would miss otherwise. Signed-off-by: BALATON Zoltan Tested-by: Chad Jablonski Reviewed-by: Chad Jablonski --- hw/display/ati.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/ati.c b/hw/display/ati.c index c165434938..8286f67c1c 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -632,6 +632,7 @@ static void ati_mm_write(void *opaque, hwaddr addr, ati_reg_write_offs(&s->regs.crtc_gen_cntl, addr - CRTC_GEN_CNTL, data, size); if ((val & CRTC2_CUR_EN) !=3D (s->regs.crtc_gen_cntl & CRTC2_CUR_E= N)) { + ati_vga_switch_mode(s); if (s->cursor_guest_mode) { s->vga.force_shadow =3D !!(s->regs.crtc_gen_cntl & CRTC2_C= UR_EN); } else { --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774110711345159.7523905121435; Sat, 21 Mar 2026 09:31:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDj-0006EJ-FM; Sat, 21 Mar 2026 12:30:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDR-00064q-Mn for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:25 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDN-0002Do-Lw for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:20 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id EB1CC596D8C; Sat, 21 Mar 2026 17:30:15 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id Oawd89xIuz0I; Sat, 21 Mar 2026 17:30:14 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id F0DDA5969F3; Sat, 21 Mar 2026 17:30:13 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <7d96c67f864845893d4903b988a4da7c7b010f66.1774110169.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 3/8] ati-vga: Do not add crtc offset to src and dst data address MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:13 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110713700154100 Content-Type: text/plain; charset="utf-8" Drivers seem to program these registers with values that already include the crtc offset so this is not needed. This fixes blit outside of vram errors with non-0 crtc offset. Signed-off-by: BALATON Zoltan Reviewed-by: Chad Jablonski --- hw/display/ati_2d.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 0cbbdc33f4..cf2d4a08e2 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -110,7 +110,6 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2= DCtx *ctx) ctx->dst_stride =3D s->regs.dst_pitch; ctx->dst_bits =3D s->vga.vram_ptr + s->regs.dst_offset; if (s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF) { - ctx->dst_bits +=3D s->regs.crtc_offset & 0x07ffffff; ctx->dst_stride *=3D ctx->bpp; } =20 @@ -121,7 +120,6 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2= DCtx *ctx) ctx->src_stride =3D s->regs.src_pitch; ctx->src_bits =3D s->vga.vram_ptr + s->regs.src_offset; if (s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF) { - ctx->src_bits +=3D s->regs.crtc_offset & 0x07ffffff; ctx->src_stride *=3D ctx->bpp; } DPRINTF("%d %d %d, %d %d %d, (%d,%d) -> (%d,%d) %dx%d %c %c\n", --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774110711591676.1665736844317; Sat, 21 Mar 2026 09:31:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDd-0006CZ-Rm; Sat, 21 Mar 2026 12:30:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDX-0006AL-22 for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:30 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDP-0002E4-AE for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:23 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 2BA06596DFE; Sat, 21 Mar 2026 17:30:17 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id m-WsSCLJNNKD; Sat, 21 Mar 2026 17:30:15 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 0730C596A4A; Sat, 21 Mar 2026 17:30:15 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <9a3263a06bc72aa5a56bafe0a11ad189d5f60528.1774110169.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 4/8] ati-vga: Avoid warnings about sign extension MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:15 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110713672158500 Content-Type: text/plain; charset="utf-8" Coverity reports several possible sign extension errors (latest is CID 1645615). These cannot happen because the values are limited when writing the registers and only 32 bits of the return value matter but change type of the variable storing the return value to uint32_t to avoid these warnings. Also change DEFAULT_SC_BOTTOM_RIGHT register read to match what other similar registers do for consistency. Signed-off-by: BALATON Zoltan Reviewed-by: Peter Maydell --- hw/display/ati.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 8286f67c1c..705e4db6e4 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -266,7 +266,7 @@ static void ati_vga_vblank_irq(void *opaque) ati_vga_update_irq(s); } =20 -static inline uint64_t ati_reg_read_offs(uint32_t reg, int offs, +static inline uint32_t ati_reg_read_offs(uint32_t reg, int offs, unsigned int size) { if (offs =3D=3D 0 && size =3D=3D 4) { @@ -279,7 +279,7 @@ static inline uint64_t ati_reg_read_offs(uint32_t reg, = int offs, static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size) { ATIVGAState *s =3D opaque; - uint64_t val =3D 0; + uint32_t val =3D 0; =20 switch (addr) { case MM_INDEX: @@ -514,8 +514,8 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, = unsigned int size) val |=3D s->regs.default_tile << 16; break; case DEFAULT_SC_BOTTOM_RIGHT: - val =3D (s->regs.default_sc_bottom << 16) | - s->regs.default_sc_right; + val =3D s->regs.default_sc_right; + val |=3D s->regs.default_sc_bottom << 16; break; case SC_TOP: val =3D s->regs.sc_top; --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774110711267620.944410590067; Sat, 21 Mar 2026 09:31:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDg-0006D9-Ob; Sat, 21 Mar 2026 12:30:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDZ-0006AQ-Mr for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:30 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDW-0002FG-RL for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:29 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 147BF596D8F; Sat, 21 Mar 2026 17:30:18 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id GGfPLY9HXwyL; Sat, 21 Mar 2026 17:30:16 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 12197596D90; Sat, 21 Mar 2026 17:30:16 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <6e1b83ef3fe7a1ebc246b474eb2b0c7cd05d5deb.1774110169.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 5/8] ati-vga: Fix display updates in non-32 bit modes MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:16 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110713520158500 Content-Type: text/plain; charset="utf-8" The memory_region_set_dirty used to mark changes should use stride value in vram which is normally only the same as surface_stride in 32 bit modes. This caused missed updates in 8 and 16 bit modes. Signed-off-by: BALATON Zoltan Reviewed-by: Chad Jablonski --- hw/display/ati_2d.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index cf2d4a08e2..23527b2c50 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -70,6 +70,7 @@ static void ati_set_dirty(VGACommonState *vga, const ATI2= DCtx *ctx) { DisplaySurface *ds =3D qemu_console_surface(vga->con); =20 + (void)ds; DPRINTF("%p %u ds: %p %d %d rop: %x\n", vga->vram_ptr, vga->vbe_start_= addr, surface_data(ds), surface_stride(ds), surface_bits_per_pixel(d= s), ctx->rop3 >> 16); @@ -78,8 +79,8 @@ static void ati_set_dirty(VGACommonState *vga, const ATI2= DCtx *ctx) vga->vbe_regs[VBE_DISPI_INDEX_YRES] * vga->vbe_line_offset) { memory_region_set_dirty(&vga->vram, vga->vbe_start_addr + ctx->dst_offset + - ctx->dst.y * surface_stride(ds), - ctx->dst.height * surface_stride(ds)); + ctx->dst.y * ctx->dst_stride, + ctx->dst.height * ctx->dst_stride); } } =20 --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774110712624555.7158060833317; Sat, 21 Mar 2026 09:31:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDg-0006Ce-8H; Sat, 21 Mar 2026 12:30:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDZ-0006AR-Pm for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:30 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDW-0002FI-Ql for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:29 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 39DB4596E01; Sat, 21 Mar 2026 17:30:19 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id tfUp1eLCUZaY; Sat, 21 Mar 2026 17:30:17 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 29B14596DFC; Sat, 21 Mar 2026 17:30:17 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <47cbdc7ad2291f22467f9fc86e7287eb8983c927.1774110169.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 6/8] ati-vga: Add work around for fuloong2e MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:17 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110713735154100 Content-Type: text/plain; charset="utf-8" With the linear aperture size fixed to match real card fuloong2e no longer works due to running out of PCI memory because only one PCI bus is emulated on that machine. Add a property to allow fuloong2e to set a smaller linear aperture size to work around that problem until the machine model is improved. Signed-off-by: BALATON Zoltan Reviewed-by: Chad Jablonski --- hw/display/ati.c | 17 +++++++++++++---- hw/display/ati_int.h | 1 + hw/mips/fuloong2e.c | 1 + 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 705e4db6e4..fba73a9956 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -1074,7 +1074,6 @@ static void ati_vga_realize(PCIDevice *dev, Error **e= rrp) ATIVGAState *s =3D ATI_VGA(dev); VGACommonState *vga =3D &s->vga; I2CBus *i2cbus; - uint64_t aper_size; =20 #ifndef CONFIG_PIXMAN if (s->use_pixman !=3D 0) { @@ -1138,10 +1137,19 @@ static void ati_vga_realize(PCIDevice *dev, Error *= *errp) * Rage128 the upper half of the aperture is reserved for an AGP * window (which we do not emulate.) */ - aper_size =3D s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF ? - ATI_RAGE128_LINEAR_APER_SIZE : ATI_R100_LINEAR_APER_SIZE; + if (!s->linear_aper_sz) { + if (s->dev_id =3D=3D PCI_DEVICE_ID_ATI_RAGE128_PF) { + s->linear_aper_sz =3D ATI_RAGE128_LINEAR_APER_SIZE; + } else { + s->linear_aper_sz =3D ATI_R100_LINEAR_APER_SIZE; + } + } + if (s->linear_aper_sz < 16 * MiB) { + error_setg(errp, "x-linear-aper-size is too small (minimum 16 MiB)= "); + return; + } memory_region_init(&s->linear_aper, OBJECT(dev), "ati-linear-aperture0= ", - aper_size); + s->linear_aper_sz); memory_region_add_subregion(&s->linear_aper, 0, &vga->vram); =20 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->linear_ape= r); @@ -1186,6 +1194,7 @@ static const Property ati_vga_properties[] =3D { DEFINE_PROP_BOOL("guest_hwcursor", ATIVGAState, cursor_guest_mode, fal= se), /* this is a debug option, prefer PROP_UINT over PROP_BIT for simplici= ty */ DEFINE_PROP_UINT8("x-pixman", ATIVGAState, use_pixman, DEFAULT_X_PIXMA= N), + DEFINE_PROP_UINT64("x-linear-aper-size", ATIVGAState, linear_aper_sz, = 0), DEFINE_EDID_PROPERTIES(ATIVGAState, i2cddc.edid_info), }; =20 diff --git a/hw/display/ati_int.h b/hw/display/ati_int.h index 21b74511e0..0c48934d33 100644 --- a/hw/display/ati_int.h +++ b/hw/display/ati_int.h @@ -119,6 +119,7 @@ struct ATIVGAState { QEMUTimer vblank_timer; bitbang_i2c_interface bbi2c; I2CDDCState i2cddc; + uint64_t linear_aper_sz; MemoryRegion linear_aper; MemoryRegion io; MemoryRegion mm; diff --git a/hw/mips/fuloong2e.c b/hw/mips/fuloong2e.c index d0efe36f7c..72ad4507df 100644 --- a/hw/mips/fuloong2e.c +++ b/hw/mips/fuloong2e.c @@ -316,6 +316,7 @@ static void mips_fuloong2e_init(MachineState *machine) dev =3D DEVICE(pci_dev); qdev_prop_set_uint32(dev, "vgamem_mb", 16); qdev_prop_set_uint16(dev, "x-device-id", 0x5159); + qdev_prop_set_uint64(dev, "x-linear-aper-size", 16 * MiB); pci_realize_and_unref(pci_dev, pci_bus, &error_fatal); } =20 --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177411072639935.914752072470264; Sat, 21 Mar 2026 09:32:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDd-0006Bp-DR; Sat, 21 Mar 2026 12:30:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDY-0006AN-I1 for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:30 -0400 Received: from zero.eik.bme.hu ([2001:738:2001:2001::2001]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDT-0002FD-Mj for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:28 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 33E6B596E00; Sat, 21 Mar 2026 17:30:20 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id Ei06dmYZsxzs; Sat, 21 Mar 2026 17:30:18 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 35DAD596E02; Sat, 21 Mar 2026 17:30:18 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 7/8] ati-vga: Simplify pointer image handling MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:18 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2001:738:2001:2001::2001; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110727687158500 Content-Type: text/plain; charset="utf-8" Rewrite reading of mouse pointer image. I am not sure this is entirely correct but appears to work at least on little endian host with PPC guests using little or big endian frame buffer (MorphOS and MacOS) but still produces broken pointer image with Linux where I am not sure if it is a guest driver bug or still missing something. Signed-off-by: BALATON Zoltan --- hw/display/ati.c | 53 ++++++++++++++++++++++-------------------------- 1 file changed, 24 insertions(+), 29 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index fba73a9956..e1616dc3b3 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -142,27 +142,24 @@ static void ati_vga_switch_mode(ATIVGAState *s) /* Used by host side hardware cursor */ static void ati_cursor_define(ATIVGAState *s) { - uint8_t data[1024]; + uint64_t data[128]; uint32_t srcoff; - int i, j, idx =3D 0; =20 if ((s->regs.cur_offset & BIT(31)) || s->cursor_guest_mode) { return; /* Do not update cursor if locked or rendered by guest */ } /* FIXME handle cur_hv_offs correctly */ - srcoff =3D s->regs.cur_offset - - (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; - for (i =3D 0; i < 64; i++) { - for (j =3D 0; j < 8; j++, idx++) { - data[idx] =3D vga_read_byte(&s->vga, srcoff + i * 16 + j); - data[512 + idx] =3D vga_read_byte(&s->vga, srcoff + i * 16 + j= + 8); - } + srcoff =3D s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - + (s->regs.cur_hv_offs & 0xffff) * 16; + for (int i =3D 0; i < 64; i++, srcoff +=3D 16) { + data[i] =3D ldq_le_p(&s->vga.vram_ptr[srcoff]); + data[i + 64] =3D ldq_le_p(&s->vga.vram_ptr[srcoff + 8]); } if (!s->cursor) { s->cursor =3D cursor_alloc(64, 64); } cursor_set_mono(s->cursor, s->regs.cur_color1, s->regs.cur_color0, - &data[512], 1, &data[0]); + (uint8_t *)&data[64], 1, (uint8_t *)&data[0]); dpy_cursor_define(s->vga.con, s->cursor); } =20 @@ -197,9 +194,9 @@ static void ati_cursor_invalidate(VGACommonState *vga) static void ati_cursor_draw_line(VGACommonState *vga, uint8_t *d, int scr_= y) { ATIVGAState *s =3D container_of(vga, ATIVGAState, vga); - uint32_t srcoff; + uint32_t h, srcoff, color; + uint64_t abits, xbits, mask; uint32_t *dp =3D (uint32_t *)d; - int i, j, h, idx =3D 0; =20 if (!(s->regs.crtc_gen_cntl & CRTC2_CUR_EN) || scr_y < vga->hw_cursor_y || scr_y >=3D vga->hw_cursor_y + 64 || @@ -210,26 +207,24 @@ static void ati_cursor_draw_line(VGACommonState *vga,= uint8_t *d, int scr_y) srcoff =3D s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16; dp =3D &dp[vga->hw_cursor_x]; h =3D ((s->regs.crtc_h_total_disp >> 16) + 1) * 8; - for (i =3D 0; i < 8; i++) { - uint32_t color; - uint8_t abits =3D vga_read_byte(vga, srcoff + i); - uint8_t xbits =3D vga_read_byte(vga, srcoff + i + 8); - for (j =3D 0; j < 8; j++, abits <<=3D 1, xbits <<=3D 1, idx++) { - if (vga->hw_cursor_x + idx >=3D h) { - return; /* end of screen, don't span to next line */ - } - if (abits & BIT(7)) { - if (xbits & BIT(7)) { - color =3D dp[idx] ^ 0xffffffff; /* complement */ - } else { - continue; /* transparent, no change */ - } + abits =3D ldq_be_p(&vga->vram_ptr[srcoff]); + xbits =3D ldq_be_p(&vga->vram_ptr[srcoff + 8]); + mask =3D BIT(63); + for (int i =3D 0; i < 64; i++, mask >>=3D 1) { + if (vga->hw_cursor_x + i >=3D h) { + return; /* end of screen, don't span to next line */ + } + if (abits & mask) { + if (xbits & mask) { + color =3D dp[i] ^ 0xffffffff; /* complement */ } else { - color =3D (xbits & BIT(7) ? s->regs.cur_color1 : - s->regs.cur_color0) | 0xff000000; + continue; /* transparent, no change */ } - dp[idx] =3D color; + } else { + color =3D (xbits & mask ? s->regs.cur_color1 : + s->regs.cur_color0) | 0xff000000; } + dp[i] =3D color; } } =20 --=20 2.41.3 From nobody Sun Mar 22 14:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=eik.bme.hu Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17741106953991009.0875458169514; Sat, 21 Mar 2026 09:31:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w3zDi-0006DC-0G; Sat, 21 Mar 2026 12:30:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDZ-0006AO-3k for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:30 -0400 Received: from zero.eik.bme.hu ([152.66.115.2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w3zDW-0002FH-P8 for qemu-devel@nongnu.org; Sat, 21 Mar 2026 12:30:28 -0400 Received: from localhost (localhost [127.0.0.1]) by zero.eik.bme.hu (Postfix) with ESMTP id 42F9E596E02; Sat, 21 Mar 2026 17:30:21 +0100 (CET) Received: from zero.eik.bme.hu ([127.0.0.1]) by localhost (zero.eik.bme.hu [127.0.0.1]) (amavis, port 10028) with ESMTP id Z9elW9acaXIw; Sat, 21 Mar 2026 17:30:19 +0100 (CET) Received: by zero.eik.bme.hu (Postfix, from userid 432) id 3F5A8596E0C; Sat, 21 Mar 2026 17:30:19 +0100 (CET) X-Virus-Scanned: amavis at eik.bme.hu Message-ID: <2ecf42bdeb96a4206b27dc39b3ff13cc8a6190d0.1774110169.git.balaton@eik.bme.hu> In-Reply-To: References: From: BALATON Zoltan Subject: [PATCH v6 8/8] ati-vga: Make sure hardware cursor data is within vram MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , marcandre.lureau@redhat.com, Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2026 17:30:19 +0100 (CET) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=152.66.115.2; envelope-from=balaton@eik.bme.hu; helo=zero.eik.bme.hu X-Spam_score_int: -1 X-Spam_score: -0.2 X-Spam_bar: / X-Spam_report: (-0.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774110697624154100 Content-Type: text/plain; charset="utf-8" Add check to make sure we don't read past the end of vram when getting mouse pointer image. Signed-off-by: BALATON Zoltan --- hw/display/ati.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/display/ati.c b/hw/display/ati.c index e1616dc3b3..d7b131d633 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -151,6 +151,9 @@ static void ati_cursor_define(ATIVGAState *s) /* FIXME handle cur_hv_offs correctly */ srcoff =3D s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; + if (srcoff + 64 * 16 > s->vga.vram_size) { + return; + } for (int i =3D 0; i < 64; i++, srcoff +=3D 16) { data[i] =3D ldq_le_p(&s->vga.vram_ptr[srcoff]); data[i + 64] =3D ldq_le_p(&s->vga.vram_ptr[srcoff + 8]); @@ -205,6 +208,9 @@ static void ati_cursor_draw_line(VGACommonState *vga, u= int8_t *d, int scr_y) } /* FIXME handle cur_hv_offs correctly */ srcoff =3D s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16; + if (srcoff + 16 > s->vga.vram_size) { + return; + } dp =3D &dp[vga->hw_cursor_x]; h =3D ((s->regs.crtc_h_total_disp >> 16) + 1) * 8; abits =3D ldq_be_p(&vga->vram_ptr[srcoff]); --=20 2.41.3