summaryrefslogtreecommitdiff
path: root/shared-core/mach64_state.c
diff options
context:
space:
mode:
authorDave Airlie <airlied@linux.ie>2007-12-10 15:53:59 +1000
committerDave Airlie <airlied@linux.ie>2007-12-10 15:53:59 +1000
commit814f695135f21aadeba77a3114df505d81a8d433 (patch)
tree277da7e1c5dce9318591158435d2e367f3e495d3 /shared-core/mach64_state.c
parente51b3c8ff4bb88bc0f57473b7c3fe7fcd6b1a916 (diff)
parentcfa21b22b43c7113107b5eb086b5f4d4ec36dc0a (diff)
Merge branch 'master' into r500-support
Diffstat (limited to 'shared-core/mach64_state.c')
-rw-r--r--shared-core/mach64_state.c16
1 files changed, 15 insertions, 1 deletions
diff --git a/shared-core/mach64_state.c b/shared-core/mach64_state.c
index 89b6c6ce..88ff4843 100644
--- a/shared-core/mach64_state.c
+++ b/shared-core/mach64_state.c
@@ -27,7 +27,7 @@
* Authors:
* Gareth Hughes <gareth@valinux.com>
* Leif Delgass <ldelgass@retinalburn.net>
- * Jos�Fonseca <j_r_fonseca@yahoo.co.uk>
+ * José Fonseca <j_r_fonseca@yahoo.co.uk>
*/
#include "drmP.h"
@@ -575,6 +575,10 @@ static int mach64_dma_dispatch_vertex(struct drm_device * dev,
return -EAGAIN;
}
+ /* Mach64's vertex data is actually register writes. To avoid security
+ * compromises these register writes have to be verified and copied from
+ * user space into a private DMA buffer.
+ */
verify_ret = copy_from_user_vertex(GETBUFPTR(copy_buf), buf, used);
if (verify_ret != 0) {
@@ -698,6 +702,16 @@ static int mach64_dma_dispatch_blit(struct drm_device * dev,
return -EAGAIN;
}
+ /* Copy the blit data from userspace.
+ *
+ * XXX: This is overkill. The most efficient solution would be having
+ * two sets of buffers (one set private for vertex data, the other set
+ * client-writable for blits). However that would bring more complexity
+ * and would break backward compatability. The solution currently
+ * implemented is keeping all buffers private, allowing to secure the
+ * driver, without increasing complexity at the expense of some speed
+ * transfering data.
+ */
verify_ret = copy_from_user_blit(GETBUFPTR(copy_buf), blit->buf, used);
if (verify_ret != 0) {