{"id":2222063,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2222063/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260410183249.4046456-3-peter.maydell@linaro.org/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.1/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260410183249.4046456-3-peter.maydell@linaro.org>","date":"2026-04-10T18:32:49","name":"[2/2] hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"33e7631417a7dccad742870f66ae659ab7810cea","submitter":{"id":5111,"url":"http://patchwork.ozlabs.org/api/1.1/people/5111/?format=json","name":"Peter Maydell","email":"peter.maydell@linaro.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260410183249.4046456-3-peter.maydell@linaro.org/mbox/","series":[{"id":499492,"url":"http://patchwork.ozlabs.org/api/1.1/series/499492/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=499492","date":"2026-04-10T18:32:49","name":"hw/display/cirrus_vga: Fix packed-24 color-expansion ops","version":1,"mbox":"http://patchwork.ozlabs.org/series/499492/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2222063/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2222063/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=HIqJrVb/;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsln071Bzz1yGS\n\tfor ; Sat, 11 Apr 2026 04:33:39 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wBGf6-0003E6-Lr; Fri, 10 Apr 2026 14:33:00 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wBGf2-0003D6-Uk\n for qemu-devel@nongnu.org; Fri, 10 Apr 2026 14:32:56 -0400","from mail-wr1-x431.google.com ([2a00:1450:4864:20::431])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from )\n id 1wBGf0-00052D-Ry\n for qemu-devel@nongnu.org; Fri, 10 Apr 2026 14:32:56 -0400","by mail-wr1-x431.google.com with SMTP id\n ffacd0b85a97d-43d01d6b50cso2356128f8f.1\n for ; Fri, 10 Apr 2026 11:32:53 -0700 (PDT)","from lanath.. (wildly.archaic.org.uk. [81.2.115.145])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-43d63e46a85sm9344714f8f.24.2026.04.10.11.32.51\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 10 Apr 2026 11:32:51 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1775845972; x=1776450772; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=W9eezskDYP8au4TA0u/saRPDrZUnsxGoUmThaVieUzw=;\n b=HIqJrVb/eErryRweJT+pEdgZWR7pXjecGJf6hnNYKPd463dquLSalrKON0A5r1BaDI\n 9wqAGQIuAlQw9MxwISit7oy7Ty1klH/tmdQUZgPz4cJW3ZK0anVn8/1K0WV6r1yHsDcr\n DqYQua3x5xiAV3zvG6YFM/O+v4BglvrLpAXyLkm1yTpWqCAhUvU1X08r8XbY1b5hg6Xy\n AYaIZ/vOIQQ2NvuQkfj9TqDT8cN1gIcmVKiYA37DC85Mlloj2X821bts18K5T0kDy/XZ\n /W6qQTCTWfyPXiM8ScQTW6PK6hEDhMnpEGoaoLV/e258YNOOMD5ngnp+UwZj+chvG1VO\n dV1Q==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775845972; x=1776450772;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=W9eezskDYP8au4TA0u/saRPDrZUnsxGoUmThaVieUzw=;\n b=PHIQDB72hbueon3YV1zxMO3p9ZnXvpnWYOdmr+L9PGZHvp4u8wkOAE8PWpBcnVxYfZ\n RqceoqwA3Hgn+hyxbX1gfwCAw9M5sEeXqJ9EtR8W3XmWDmWSSp6ifBMccFmWOq2rGG4d\n jdEeSadlLFxc3jLkhF4vm+iKdk9LG0Z2rqlHIquk0Zw9CaeLlMzyxrXP3UXhO6wPrPf1\n Bd7Y3GAcMg2YKjz0ykEmH0qopQp7/wOdYrS7LrgQmov18IA0QSuwtj82czjqHt3jhx5O\n hqDBHDMqpQIZT+iWw7R3Smg7t8mJSQMaaUjpWujuLa1AOsi+MMieTzgILwFgEFfdCjE0\n 4lbA==","X-Gm-Message-State":"AOJu0YzcAJ1vTMOw3ztMRsSy6ejGrwXDYGvWmvl4hn/48qroCzuSl6UB\n MGKaoiPDQHNg3F+/vmS2aD4JP1MWSlF+xi1heLhxG+MQlgja+lRwUxCXfLVYJTBeJZjIZevNM8o\n 9WG3j84M=","X-Gm-Gg":"AeBDiesZSkQnVdH47MK172DbDStno7U2EOCxo8rL17ZskbuJ1FPvylizTocVQmu4CqS\n ppg7gd80M/a5MINxrvySrbtd4hh9PwKLZUJP589W4n2G5xCDdw6v9xyM5cGSQaH7FLYwzw7U9ll\n X4nOVbS5gTnsMKvf3BmX/46UWsnEjJJcf9TqBlBGjmUlaH9NRGBvU/TuYWi9noVigzZ2CRD1lj9\n LhSfg0lx0pLdJUWMs/VxFpDJy1TVVwCNwHXcL+zOLflViE7sGFeu1YhXL5NxctS9L7LkwxAoiTQ\n 9w1XiPFSql6HWGbdBBDh0zDFx9Z5mfCtFZ0HzPmUCjEKJ/EscWqdH5U90vAFx4fGbep9xWu/fPw\n j9cAQb5VS4+deLDxXVZTofEczxSrhk9u5A3nWt70cNrar7uU40/HSl6ydkCWRcDftoGkNjrr7O9\n G1mLE/CzkY9QmZYkYNMHzjW3ejFncqCL9dk96cVcIdSu3nQZ4FDKNGUECwgXvCTg4ugorfFjc1E\n zlYgDJAjPjDC/GcuZ+Yic2S5dXZPsw=","X-Received":"by 2002:a05:6000:2586:b0:43c:f925:8fc0 with SMTP id\n ffacd0b85a97d-43d642dd84fmr6449431f8f.50.1775845972488;\n Fri, 10 Apr 2026 11:32:52 -0700 (PDT)","From":"Peter Maydell ","To":"qemu-devel@nongnu.org","Cc":"Gerd Hoffmann ","Subject":"[PATCH 2/2] hw/display/cirrus_vga: Fix packed-24 color-expansion\n transparent copies","Date":"Fri, 10 Apr 2026 19:32:49 +0100","Message-ID":"<20260410183249.4046456-3-peter.maydell@linaro.org>","X-Mailer":"git-send-email 2.43.0","In-Reply-To":"<20260410183249.4046456-1-peter.maydell@linaro.org>","References":"<20260410183249.4046456-1-peter.maydell@linaro.org>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=2a00:1450:4864:20::431;\n envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x431.google.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"For the \"color expansion\" subtype of raster operations, the source\npixel format is a monochrome bitmap, and the destination can be any\nof 8, 16, 24 or 32bpp.\n\nFor these pattern operations, the GR2F register includes a field\nwhich specifies how much to skip at the start of each scanline. In\nthe 8, 16 and 32 bit cases, this field is 3 bits and is a count of\npixels to skip. We get this case right. However, for the 24 bit\ncase, the field is 5 bits and is a count of destination bytes to\nskip.\n\nIn commit ad81218e40e27 (\"depth=24 write mask fix (Volker Ruppert)\")\nin 2005, we updated the code to (attempt to) handle the 5-bit mask\ncase. However, we don't do the right thing when the 5-bit mask\nindicates that we need to skip more than 8 bits of the input bitmap:\nwe will right-shift the 0x80 constant completely off the right hand\nside, and will be off-by-one for all the source bitmap loads.\n\nFix this by calculating the whole number of input bytes we need to\nskip and the residual number of bits. In the 8/16/32bpp case the\nbytes to skip is always zero.\n\nCc: qemu-stable@nongnu.org\nFixes: ad81218e40e27 (\"depth=24 write mask fix (Volker Ruppert)\")\nSigned-off-by: Peter Maydell \n---\n hw/display/cirrus_vga_rop2.h | 31 +++++++++++++++++++++++++++----\n 1 file changed, 27 insertions(+), 4 deletions(-)","diff":"diff --git a/hw/display/cirrus_vga_rop2.h b/hw/display/cirrus_vga_rop2.h\nindex 8be35ec6e2..33f9b3b613 100644\n--- a/hw/display/cirrus_vga_rop2.h\n+++ b/hw/display/cirrus_vga_rop2.h\n@@ -108,12 +108,34 @@ glue(glue(glue(cirrus_colorexpand_transp_, ROP_NAME), _),DEPTH)\n unsigned int col;\n unsigned bitmask;\n unsigned index;\n+\n+ /*\n+ * Raster ops where the source is a monochrome bitmap with\n+ * color expansion to 8/16/24/32bpp destination.\n+ */\n+\n #if DEPTH == 24\n+ /*\n+ * For packed-24 modes, GR2F bits [4:0] are a count of destination\n+ * bytes to be suppressed for each scanline, which we keep in\n+ * dstskipleft. We want to track the number of whole bytes\n+ * to skip in the source (always either 0 or 1) and the number\n+ * of bits within the byte to skip.\n+ */\n int dstskipleft = s->vga.gr[0x2f] & 0x1f;\n- int srcskipleft = dstskipleft / 3;\n+ int srcskipleftbits = (dstskipleft / 3) & 0x7;\n+ int srcskipleftbytes = (dstskipleft / 3) >> 3;\n #else\n- int srcskipleft = s->vga.gr[0x2f] & 0x07;\n- int dstskipleft = srcskipleft * (DEPTH / 8);\n+ /*\n+ * In all other modes, GR2F bits [2:0] are a count of how many\n+ * destination pixels to suppress for each scanline, which is our\n+ * srcskipleftbits. We get dstskipleft, the number of bytes to\n+ * skip, by multiplying this by the bytes-per-pixel. In these\n+ * modes we never need to skip an entire source byte.\n+ */\n+ int srcskipleftbits = s->vga.gr[0x2f] & 0x07;\n+ int srcskipleftbytes = 0;\n+ int dstskipleft = srcskipleftbits * (DEPTH / 8);\n #endif\n \n if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_COLOREXPINV) {\n@@ -125,7 +147,8 @@ glue(glue(glue(cirrus_colorexpand_transp_, ROP_NAME), _),DEPTH)\n }\n \n for(y = 0; y < bltheight; y++) {\n- bitmask = 0x80 >> srcskipleft;\n+ bitmask = 0x80 >> srcskipleftbits;\n+ srcaddr += srcskipleftbytes;\n bits = cirrus_src(s, srcaddr++) ^ bits_xor;\n addr = dstaddr + dstskipleft;\n for (x = dstskipleft; x < bltwidth; x += (DEPTH / 8)) {\n","prefixes":["2/2"]}