1 files changed, 62 insertions, 14 deletions

diff --git a/shared/via_dma.c b/shared/via_dma.c
index 4afc5215..d9a1fb1a 100644
--- a/shared/via_dma.c
+++ b/shared/via_dma.c
@@ -24,6 +24,57 @@ static void via_cmdbuf_reset(drm_via_private_t * dev_priv);
 static void via_cmdbuf_rewind(drm_via_private_t * dev_priv);
 static int  via_wait_idle(drm_via_private_t * dev_priv);
 
+
+/*
+ * This function needs to be extended whenever a new command set
+ * is implemented. Currently it works only for the 2D engine
+ * command, which on the Unichrome allows writing to
+ * at least the 2D engine and the mpeg engine, but not the
+ * video engine.
+ *
+ * If you update this function with new commands, please also
+ * consider implementing these commands in 
+ * via_parse_pci_cmdbuffer below.
+ *
+ * Carefully review this function for security holes 
+ * after an update!!!!!!!!!
+ */
+
+static int via_check_command_stream(const uint32_t *buf,
+				    unsigned int size) 
+{
+
+	uint32_t offset;
+	unsigned int i;
+
+	if (size & 7) {
+		DRM_ERROR("Illegal command buffer size.\n");
+		return DRM_ERR( EINVAL );
+	}
+	size >>=3;
+	for (i=0; i<size; ++i) {
+		offset = *buf; 
+		buf += 2;
+		if ((offset > ((0x3FF >> 2) | VIA_2D_CMD)) && 
+		    (offset < ((0xC00 >> 2) | VIA_2D_CMD)) ) {
+			DRM_ERROR("Attempt to access Burst Command / 3D Area.\n");
+			return DRM_ERR( EINVAL );
+		} else if (offset > ((0xDFF >> 2) | VIA_2D_CMD)) {
+			DRM_ERROR("Attempt to access DMA or VGA registers.\n");
+			return DRM_ERR( EINVAL );
+		}
+
+		/*
+		 * ...
+		 * A volunteer should complete this to allow non-root
+		 * usage of accelerated 3D OpenGL.
+		 */
+
+	}
+	return 0;
+}
+  
+
 static inline int
 via_cmdbuf_wait(drm_via_private_t * dev_priv, unsigned int size)
 {
@@ -163,6 +214,8 @@ static int via_dispatch_cmdbuffer(drm_device_t *dev,
 {
 	drm_via_private_t *dev_priv = dev->dev_private;
 	uint32_t * vb;
+	int ret;
+
 	vb = via_check_dma(dev_priv, cmd->size);
 	if (vb == NULL) {
 		return DRM_ERR(EAGAIN);
@@ -170,6 +223,10 @@ static int via_dispatch_cmdbuffer(drm_device_t *dev,
 	if (DRM_COPY_FROM_USER(vb, cmd->buf, cmd->size)) {
 		return DRM_ERR(EFAULT);
 	}
+	  
+	if ((ret = via_check_command_stream( vb, cmd->size)))
+		return ret;
+
 	dev_priv->dma_low += cmd->size;
 	via_cmdbuf_pause(dev_priv);
 
@@ -225,6 +282,7 @@ int via_cmdbuffer( DRM_IOCTL_ARGS )
 	return 0;
 }
 
+
 static int via_parse_pci_cmdbuffer( drm_device_t *dev, const char *buf, 
 				    unsigned int size )
 {
@@ -232,22 +290,12 @@ static int via_parse_pci_cmdbuffer( drm_device_t *dev, const char *buf,
 	uint32_t offset, value;
 	const uint32_t *regbuf = (uint32_t *)buf;
 	unsigned int i;
+	int ret;
 
+	if ((ret = via_check_command_stream( regbuf, size)))
+		return ret;
+		
 	size >>=3 ;
-	for (i=0; i<size; ++i) {
-		offset = *regbuf; 
-		regbuf += 2;
-		if ((offset > ((0x7FF >> 2) | VIA_2D_CMD)) && 
-		    (offset < ((0xC00 >> 2) | VIA_2D_CMD)) ) {
-			DRM_DEBUG("Attempt to access Burst Command Area.\n");
-			return DRM_ERR( EINVAL );
-		} else if (offset > ((0xDFF >> 2) | VIA_2D_CMD)) {
-			DRM_DEBUG("Attempt to access DMA or VGA registers.\n");
-			return DRM_ERR( EINVAL );
-		}
-	}
-			
-	regbuf = (uint32_t *)buf;
 	for ( i=0; i<size; ++i ) {
 		offset = (*regbuf++ & ~VIA_2D_CMD) << 2;
 		value = *regbuf++;