summaryrefslogtreecommitdiff
path: root/shared-core/mach64_state.c
diff options
context:
space:
mode:
authorDave Airlie <airlied@linux.ie>2007-12-11 16:58:00 +1000
committerDave Airlie <airlied@linux.ie>2007-12-11 16:58:00 +1000
commit8d2da202337300e821f4867cb2654b41ff6053b6 (patch)
treec7b0c4644c99180081eaa3f2e4bf0d1b4f8bbd63 /shared-core/mach64_state.c
parentf99dea7db00dd46aa96eaed3a61dff9c956fd86f (diff)
parentcfa21b22b43c7113107b5eb086b5f4d4ec36dc0a (diff)
Merge branch 'master' of ssh://git.freedesktop.org/git/mesa/drm into modesetting-101
Conflicts: linux-core/drm_drv.c shared-core/drm.h shared-core/i915_dma.c
Diffstat (limited to 'shared-core/mach64_state.c')
-rw-r--r--shared-core/mach64_state.c16
1 files changed, 15 insertions, 1 deletions
diff --git a/shared-core/mach64_state.c b/shared-core/mach64_state.c
index 89b6c6ce..88ff4843 100644
--- a/shared-core/mach64_state.c
+++ b/shared-core/mach64_state.c
@@ -27,7 +27,7 @@
* Authors:
* Gareth Hughes <gareth@valinux.com>
* Leif Delgass <ldelgass@retinalburn.net>
- * Jos�Fonseca <j_r_fonseca@yahoo.co.uk>
+ * José Fonseca <j_r_fonseca@yahoo.co.uk>
*/
#include "drmP.h"
@@ -575,6 +575,10 @@ static int mach64_dma_dispatch_vertex(struct drm_device * dev,
return -EAGAIN;
}
+ /* Mach64's vertex data is actually register writes. To avoid security
+ * compromises these register writes have to be verified and copied from
+ * user space into a private DMA buffer.
+ */
verify_ret = copy_from_user_vertex(GETBUFPTR(copy_buf), buf, used);
if (verify_ret != 0) {
@@ -698,6 +702,16 @@ static int mach64_dma_dispatch_blit(struct drm_device * dev,
return -EAGAIN;
}
+ /* Copy the blit data from userspace.
+ *
+ * XXX: This is overkill. The most efficient solution would be having
+ * two sets of buffers (one set private for vertex data, the other set
+ * client-writable for blits). However that would bring more complexity
+ * and would break backward compatability. The solution currently
+ * implemented is keeping all buffers private, allowing to secure the
+ * driver, without increasing complexity at the expense of some speed
+ * transfering data.
+ */
verify_ret = copy_from_user_blit(GETBUFPTR(copy_buf), blit->buf, used);
if (verify_ret != 0) {