+-- On Tue, 20 Oct 2020, BALATON Zoltan wrote --+
| The card has 32 bit registers with values in them interpreted differently for
| different regs. For dst_x|y lower 14 bits can be set and value should be
| interpreted as -8192:8191 according to docs. I've got this wrong because all
| guests I've t
Hello,
On Tue, 20 Oct 2020, P J P wrote:
+-- On Mon, 19 Oct 2020, BALATON Zoltan wrote --+
| On Mon, 19 Oct 2020, P J P wrote:
| >dst_x = ... (s->regs.dst_x(=0) + 1 - s->regs.dst_width(=16383))
| >dst_y = ... (s->regs.dst_y(=0) + 1 - s->regs.dst_height(=16383))
| >
| > ati_2d_blt
| >
Hi,
+-- On Mon, 19 Oct 2020, BALATON Zoltan wrote --+
| On Mon, 19 Oct 2020, P J P wrote:
| >dst_x = ... (s->regs.dst_x(=0) + 1 - s->regs.dst_width(=16383))
| >dst_y = ... (s->regs.dst_y(=0) + 1 - s->regs.dst_height(=16383))
| >
| > ati_2d_blt
| >pixman_blt(0x7f03cbe0, 0x7f03cbe
On Mon, 19 Oct 2020, P J P wrote:
+-- On Sun, 18 Oct 2020, BALATON Zoltan wrote --+
| The s->regs.[src|dst]_[xy] values should not be over 0x3fff because we mask
| them on register write in ati.c
Yes, those register values are set to zero(0).
| and here [src|dst]_[x|y] local variables are decl
+-- On Sun, 18 Oct 2020, BALATON Zoltan wrote --+
| The s->regs.[src|dst]_[xy] values should not be over 0x3fff because we mask
| them on register write in ati.c
Yes, those register values are set to zero(0).
| and here [src|dst]_[x|y] local variables are declared unsigned so negative
| value
On Sun, 18 Oct 2020, P J P wrote:
From: Prasad J Pandit
The source and destination x,y display parameters in ati_2d_blt()
may run off the vga limits if either of s->regs.[src|dst]_[xy] is
zero. Mask the register values to avoid potential crash.
Reported-by: Gaoning Pan
Signed-off-by: Prasad J
From: Prasad J Pandit
The source and destination x,y display parameters in ati_2d_blt()
may run off the vga limits if either of s->regs.[src|dst]_[xy] is
zero. Mask the register values to avoid potential crash.
Reported-by: Gaoning Pan
Signed-off-by: Prasad J Pandit
---
hw/display/ati_2d.c |
