File 0354-sm501-Implement-negated-destination.patch of Package qemu.29142

From: Sebastian Bauer <mail@sebastianbauer.info>
Date: Wed, 4 Jul 2018 11:40:58 +0200
Subject: sm501: Implement negated destination raster operation mode

Git-commit: debc7e7dad1e70c03d585d96625da0038eba375c
References: bsc#1172385, CVE-2020-12829

Add support for the negated destination operation mode. This is used e.g.
by AmigaOS for the INVERSEVID drawing mode. With this change, the cursor
in the shell and non-immediate window adjustment are working now.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/display/sm501.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index d047febf634610cc4b3a6e9105a4..aaeb4f30322acf4681bb3ab255f0 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -671,6 +671,8 @@ static void sm501_2d_operation(SM501State * s)
     uint32_t color = s->twoD_foreground;
     int format_flags = (s->twoD_stretch >> 20) & 0x3;
     int addressing = (s->twoD_stretch >> 16) & 0xF;
+    int rop_mode = (s->twoD_control >> 15) & 0x1; /* 1 for rop2, else rop3 */
+    int rop = s->twoD_control & 0xFF;
 
     /* get frame buffer info */
     uint8_t * src = s->local_mem + (s->twoD_source_base & 0x03FFFFFF);
@@ -702,7 +704,13 @@ static void sm501_2d_operation(SM501State * s)
                     index_s = ((src_y + y) * src_width + src_x + x) * _bpp; \
                     index_d = ((dst_y + y) * dst_width + dst_x + x) * _bpp; \
                 }                                                           \
-                *(_pixel_type*)&dst[index_d] = *(_pixel_type*)&src[index_s];\
+                if (rop_mode == 1 && rop == 5) {                              \
+                    /* Invert dest */                                         \
+                    val = ~*(_pixel_type *)&dst[index_d];                     \
+                } else {                                                      \
+                    val = *(_pixel_type *)&src[index_s];                      \
+                }                                                             \
+                *(_pixel_type *)&dst[index_d] = val;                          \
             }                                                               \
         }                                                                   \
     }