diff options
author | José Fonseca <jrfonseca@tungstengraphics.com> | 2007-12-08 19:21:27 +0000 |
---|---|---|
committer | José Fonseca <jrfonseca@tungstengraphics.com> | 2007-12-08 19:23:18 +0000 |
commit | 7d08b816b7af3cd415bebf65f44313415fea091a (patch) | |
tree | 444f93f0739d0a27a6c31238d50dcadfb9945d94 /shared-core/mach64_state.c | |
parent | bfc29606e4a818897eebca46a5e23bbe7bc3ce25 (diff) |
mach64: comment bus master / ring buffer behavior and security
Diffstat (limited to 'shared-core/mach64_state.c')
-rw-r--r-- | shared-core/mach64_state.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/shared-core/mach64_state.c b/shared-core/mach64_state.c index 6fcae948..88ff4843 100644 --- a/shared-core/mach64_state.c +++ b/shared-core/mach64_state.c @@ -575,6 +575,10 @@ static int mach64_dma_dispatch_vertex(struct drm_device * dev, return -EAGAIN; } + /* Mach64's vertex data is actually register writes. To avoid security + * compromises these register writes have to be verified and copied from + * user space into a private DMA buffer. + */ verify_ret = copy_from_user_vertex(GETBUFPTR(copy_buf), buf, used); if (verify_ret != 0) { @@ -698,6 +702,16 @@ static int mach64_dma_dispatch_blit(struct drm_device * dev, return -EAGAIN; } + /* Copy the blit data from userspace. + * + * XXX: This is overkill. The most efficient solution would be having + * two sets of buffers (one set private for vertex data, the other set + * client-writable for blits). However that would bring more complexity + * and would break backward compatability. The solution currently + * implemented is keeping all buffers private, allowing to secure the + * driver, without increasing complexity at the expense of some speed + * transfering data. + */ verify_ret = copy_from_user_blit(GETBUFPTR(copy_buf), blit->buf, used); if (verify_ret != 0) { |