qemu with hax to log dma reads & writes jcs.org/2018/11/12/vfio

cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16

The switch from pointers to addresses (commit
026aeffcb4752054830ba203020ed6eb05bcaba8 and
ffaf857778286ca54e3804432a2369a279e73aa7) added
a off-by-one bug to 16bit backward blits. Fix.

Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Li Qiang <liqiang6-s@360.cn>
Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com

+1 -1
+1 -1
hw/display/cirrus_vga_rop.h
··· 219 219 srcpitch += bltwidth; 220 220 for (y = 0; y < bltheight; y++) { 221 221 for (x = 0; x < bltwidth; x+=2) { 222 - ROP_OP_TR_16(s, dstaddr, cirrus_src16(s, srcaddr), transp); 222 + ROP_OP_TR_16(s, dstaddr - 1, cirrus_src16(s, srcaddr - 1), transp); 223 223 dstaddr -= 2; 224 224 srcaddr -= 2; 225 225 }