diff options
| author | Dave Airlie <airlied@linux.ie> | 2007-12-10 15:53:59 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@linux.ie> | 2007-12-10 15:53:59 +1000 |
| commit | 814f695135f21aadeba77a3114df505d81a8d433 (patch) | |
| tree | 277da7e1c5dce9318591158435d2e367f3e495d3 /shared-core/mach64_state.c | |
| parent | e51b3c8ff4bb88bc0f57473b7c3fe7fcd6b1a916 (diff) | |
| parent | cfa21b22b43c7113107b5eb086b5f4d4ec36dc0a (diff) | |
Merge branch 'master' into r500-support
Diffstat (limited to 'shared-core/mach64_state.c')
| -rw-r--r-- | shared-core/mach64_state.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/shared-core/mach64_state.c b/shared-core/mach64_state.c index 89b6c6ce..88ff4843 100644 --- a/shared-core/mach64_state.c +++ b/shared-core/mach64_state.c @@ -27,7 +27,7 @@ * Authors: * Gareth Hughes <gareth@valinux.com> * Leif Delgass <ldelgass@retinalburn.net> - * Jos�Fonseca <j_r_fonseca@yahoo.co.uk> + * José Fonseca <j_r_fonseca@yahoo.co.uk> */ #include "drmP.h" @@ -575,6 +575,10 @@ static int mach64_dma_dispatch_vertex(struct drm_device * dev, return -EAGAIN; } + /* Mach64's vertex data is actually register writes. To avoid security + * compromises these register writes have to be verified and copied from + * user space into a private DMA buffer. + */ verify_ret = copy_from_user_vertex(GETBUFPTR(copy_buf), buf, used); if (verify_ret != 0) { @@ -698,6 +702,16 @@ static int mach64_dma_dispatch_blit(struct drm_device * dev, return -EAGAIN; } + /* Copy the blit data from userspace. + * + * XXX: This is overkill. The most efficient solution would be having + * two sets of buffers (one set private for vertex data, the other set + * client-writable for blits). However that would bring more complexity + * and would break backward compatability. The solution currently + * implemented is keeping all buffers private, allowing to secure the + * driver, without increasing complexity at the expense of some speed + * transfering data. + */ verify_ret = copy_from_user_blit(GETBUFPTR(copy_buf), blit->buf, used); if (verify_ret != 0) { |