Commit 3528af1b authored by Dave Airlie's avatar Dave Airlie Committed by Dave Airlie
Browse files

drm: fix a LOR issue on FreeBSD for savage driver 



Correct a LOR issue on FreeBSD by allocating temporary space and doing a single
DRM_COPY_FROM_USER rather than DRM_VERIFYAREA_READ followed by tons of
DRM_COPY_FROM_USER_UNCHECKED.  I don't like the look of the temporary space
allocation, but I like the simplification in the rest of the file.  Tested
with glxgears, tuxracer, and q3 on a savage4.

From: Eric Anholt <anholt@freebsd.org>
Signed-off-by: default avatarDave Airlie <airlied@linux.ie>
parent 952d751a

drivers/char/drm/savage_drv.h

+7 −16
Original line number Diff line number Diff line 
/* savage_drv.h -- Private header for the savage driver

 *

/* savage_drv.h -- Private header for the savage driver */

/*

 * Copyright 2004  Felix Kuehling

 * All Rights Reserved.

 *
@@ -192,7 +192,7 @@ typedef struct drm_savage_private { 
	/* Err, there is a macro wait_event in include/linux/wait.h.

	 * Avoid unwanted macro expansion. */

	void (*emit_clip_rect) (struct drm_savage_private * dev_priv,

				drm_clip_rect_t * pbox);

				const drm_clip_rect_t * pbox);

	void (*dma_flush) (struct drm_savage_private * dev_priv);

} drm_savage_private_t;
@@ -217,9 +217,9 @@ extern void savage_reclaim_buffers(drm_device_t * dev, DRMFILE filp); 


/* state functions */

extern void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,

				      drm_clip_rect_t * pbox);

				      const drm_clip_rect_t * pbox);

extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,

				     drm_clip_rect_t * pbox);

				     const drm_clip_rect_t * pbox);



#define SAVAGE_FB_SIZE_S3	0x01000000	/*  16MB */

#define SAVAGE_FB_SIZE_S4	0x02000000	/*  32MB */
@@ -502,15 +502,6 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv, 


#define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val)



#define BCI_COPY_FROM_USER(src,n) do {				\

    unsigned int i;						\

    for (i = 0; i < n; ++i) {					\

	uint32_t val;						\

	DRM_GET_USER_UNCHECKED(val, &((uint32_t*)(src))[i]);	\

	BCI_WRITE(val);						\

    }								\

} while(0)



/*

 * command DMA support

 */
@@ -536,8 +527,8 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv, 


#define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val)



#define DMA_COPY_FROM_USER(src,n) do {				\

	DRM_COPY_FROM_USER_UNCHECKED(dma_ptr, (src), (n)*4);	\

#define DMA_COPY(src, n) do {					\

	memcpy(dma_ptr, (src), (n)*4);				\

	dma_ptr += n;						\

} while(0)

drivers/char/drm/savage_state.c

+164 −160

File changed.

Preview size limit exceeded, changes collapsed.

CRA Git | Maintained and supported by SUSTech CRA and CCSE