diff options
| author | Dave Airlie <airlied@linux.ie> | 2007-12-11 16:58:00 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@linux.ie> | 2007-12-11 16:58:00 +1000 |
| commit | 8d2da202337300e821f4867cb2654b41ff6053b6 (patch) | |
| tree | c7b0c4644c99180081eaa3f2e4bf0d1b4f8bbd63 /shared-core/mach64_state.c | |
| parent | f99dea7db00dd46aa96eaed3a61dff9c956fd86f (diff) | |
| parent | cfa21b22b43c7113107b5eb086b5f4d4ec36dc0a (diff) | |
Merge branch 'master' of ssh://git.freedesktop.org/git/mesa/drm into modesetting-101
Conflicts:
linux-core/drm_drv.c
shared-core/drm.h
shared-core/i915_dma.c
Diffstat (limited to 'shared-core/mach64_state.c')
| -rw-r--r-- | shared-core/mach64_state.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/shared-core/mach64_state.c b/shared-core/mach64_state.c index 89b6c6ce..88ff4843 100644 --- a/shared-core/mach64_state.c +++ b/shared-core/mach64_state.c @@ -27,7 +27,7 @@ * Authors: * Gareth Hughes <gareth@valinux.com> * Leif Delgass <ldelgass@retinalburn.net> - * Jos�Fonseca <j_r_fonseca@yahoo.co.uk> + * José Fonseca <j_r_fonseca@yahoo.co.uk> */ #include "drmP.h" @@ -575,6 +575,10 @@ static int mach64_dma_dispatch_vertex(struct drm_device * dev, return -EAGAIN; } + /* Mach64's vertex data is actually register writes. To avoid security + * compromises these register writes have to be verified and copied from + * user space into a private DMA buffer. + */ verify_ret = copy_from_user_vertex(GETBUFPTR(copy_buf), buf, used); if (verify_ret != 0) { @@ -698,6 +702,16 @@ static int mach64_dma_dispatch_blit(struct drm_device * dev, return -EAGAIN; } + /* Copy the blit data from userspace. + * + * XXX: This is overkill. The most efficient solution would be having + * two sets of buffers (one set private for vertex data, the other set + * client-writable for blits). However that would bring more complexity + * and would break backward compatability. The solution currently + * implemented is keeping all buffers private, allowing to secure the + * driver, without increasing complexity at the expense of some speed + * transfering data. + */ verify_ret = copy_from_user_blit(GETBUFPTR(copy_buf), blit->buf, used); if (verify_ret != 0) { |