ati-vga: mask out lock bit from CUR_OFFSET in cursor offset calculation
Bit 31 of CUR_OFFSET is the cursor lock bit, not part of the actual cursor address (bits 26:4). Although the callers already check for the lock bit and return early, mask it out with 0x07fffff0 when computing the cursor source offset so the calculation only uses the address bits. Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <20260414213523.1125859-2-junjie.cao@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Junjie Cao committed
Apr 15, 2026 at 05:35 UTC
536b4746a33ea1b009b0a96eb0710786735948f6
1 file changed
+5
-3
hw/display/ati.c
+5
-3
@@ -147,7 +147,7 @@ static void ati_cursor_define(ATIVGAState *s)
147
return; /* Do not update cursor if locked or rendered by guest */
148
}
149
/* FIXME handle cur_hv_offs correctly */
150
- srcoff = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
150
+ srcoff = (s->regs.cur_offset & 0x07fffff0) - (s->regs.cur_hv_offs >> 16) -
151
(s->regs.cur_hv_offs & 0xffff) * 16;
152
if (srcoff > s->vga.vram_size - 64 * 16) {
153
return;
@@ -176,13 +176,15 @@ static void ati_cursor_invalidate(VGACommonState *vga)
176
if (s->cursor_size != size ||
177
vga->hw_cursor_x != s->regs.cur_hv_pos >> 16 ||
178
vga->hw_cursor_y != (s->regs.cur_hv_pos & 0xffff) ||
179
- s->cursor_offset != s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
179
+ s->cursor_offset != (s->regs.cur_offset & 0x07fffff0) -
180
+ (s->regs.cur_hv_offs >> 16) -
181
(s->regs.cur_hv_offs & 0xffff) * 16) {
182
/* Remove old cursor then update and show new one if needed */
183
vga_invalidate_scanlines(vga, vga->hw_cursor_y, vga->hw_cursor_y + 63);
184
vga->hw_cursor_x = s->regs.cur_hv_pos >> 16;
185
vga->hw_cursor_y = s->regs.cur_hv_pos & 0xffff;
185
- s->cursor_offset = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) -
186
+ s->cursor_offset = (s->regs.cur_offset & 0x07fffff0) -
187
+ (s->regs.cur_hv_offs >> 16) -
188
(s->regs.cur_hv_offs & 0xffff) * 16;
189
s->cursor_size = size;
190
if (size) {