diff options
| author | BALATON Zoltan <balaton@eik.bme.hu> | 2019-03-18 23:34:46 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2019-03-26 12:06:49 +0100 |
| commit | 339534d402524d75209df5d287464e17feb6941f (patch) | |
| tree | 0a51f2b2802d4384e819e87d5ea71b511ae8cce6 | |
| parent | ab8789987f5e8d09b71e7425f3980b259967e17c (diff) | |
| download | qemu-339534d402524d75209df5d287464e17feb6941f.zip qemu-339534d402524d75209df5d287464e17feb6941f.tar.gz qemu-339534d402524d75209df5d287464e17feb6941f.tar.bz2 | |
ati-vga: Fix indexed access to video memory
Coverity (CID 1399700) found that this was wrong so instead of trying
to do it by hand use existing access functions that should work better.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20190318223842.427CB7456B2@zero.eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | hw/display/ati.c | 18 |
1 files changed, 6 insertions, 12 deletions
diff --git a/hw/display/ati.c b/hw/display/ati.c index 8322f52..db409be 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -235,12 +235,9 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size) case MM_DATA ... MM_DATA + 3: /* indexed access to regs or memory */ if (s->regs.mm_index & BIT(31)) { - if (s->regs.mm_index <= s->vga.vram_size - size) { - int i = size - 1; - while (i >= 0) { - val <<= 8; - val |= s->vga.vram_ptr[s->regs.mm_index + i--]; - } + uint32_t idx = s->regs.mm_index & ~BIT(31); + if (idx <= s->vga.vram_size - size) { + val = ldn_le_p(s->vga.vram_ptr + idx, size); } } else { val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size); @@ -434,12 +431,9 @@ static void ati_mm_write(void *opaque, hwaddr addr, case MM_DATA ... MM_DATA + 3: /* indexed access to regs or memory */ if (s->regs.mm_index & BIT(31)) { - if (s->regs.mm_index <= s->vga.vram_size - size) { - int i = 0; - while (i < size) { - s->vga.vram_ptr[s->regs.mm_index + i] = data & 0xff; - data >>= 8; - } + uint32_t idx = s->regs.mm_index & ~BIT(31); + if (idx <= s->vga.vram_size - size) { + stn_le_p(s->vga.vram_ptr + idx, size, data); } } else { ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size); |