File 0197-sm501-Implement-negated-destination.patch of Package qemu.19805
From: Sebastian Bauer <mail@sebastianbauer.info>
Date: Wed, 4 Jul 2018 11:40:58 +0200
Subject: sm501: Implement negated destination raster operation mode
Git-commit: debc7e7dad1e70c03d585d96625da0038eba375c
References: bsc#1172385, CVE-2020-12829
Add support for the negated destination operation mode. This is used e.g.
by AmigaOS for the INVERSEVID drawing mode. With this change, the cursor
in the shell and non-immediate window adjustment are working now.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
hw/display/sm501.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 58986355b2457952eb3d1821a50e..48b5b1afd94283471ce74333e9c0 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -687,6 +687,8 @@ static void sm501_2d_operation(SM501State *s)
uint32_t color = s->twoD_foreground;
int format_flags = (s->twoD_stretch >> 20) & 0x3;
int addressing = (s->twoD_stretch >> 16) & 0xF;
+ int rop_mode = (s->twoD_control >> 15) & 0x1; /* 1 for rop2, else rop3 */
+ int rop = s->twoD_control & 0xFF;
/* get frame buffer info */
uint8_t *src = s->local_mem + (s->twoD_source_base & 0x03FFFFFF);
@@ -711,6 +713,8 @@ static void sm501_2d_operation(SM501State *s)
int y, x, index_d, index_s; \
for (y = 0; y < operation_height; y++) { \
for (x = 0; x < operation_width; x++) { \
+ _pixel_type val; \
+ \
if (rtl) { \
index_s = ((src_y - y) * src_width + src_x - x) * _bpp; \
index_d = ((dst_y - y) * dst_width + dst_x - x) * _bpp; \
@@ -718,7 +722,13 @@ static void sm501_2d_operation(SM501State *s)
index_s = ((src_y + y) * src_width + src_x + x) * _bpp; \
index_d = ((dst_y + y) * dst_width + dst_x + x) * _bpp; \
} \
- *(_pixel_type *)&dst[index_d] = *(_pixel_type *)&src[index_s];\
+ if (rop_mode == 1 && rop == 5) { \
+ /* Invert dest */ \
+ val = ~*(_pixel_type *)&dst[index_d]; \
+ } else { \
+ val = *(_pixel_type *)&src[index_s]; \
+ } \
+ *(_pixel_type *)&dst[index_d] = val; \
} \
} \
}
