Print this page
7217 Buffer overflow in i915 driver
Reviewed by: Dan McDonald <danmcd@omniti.com>
Reviewed by: Richard Lowe <richlowe@richlowe.net>
Reviewed by: Garrett D'Amore <garrett@damore.org>
Reviewed by: Toomas Soome <tsoome@me.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/intel/io/drm/i915_drv.c
          +++ new/usr/src/uts/intel/io/drm/i915_drv.c
↓ open down ↓ 32 lines elided ↑ open up ↑
  33   33   *    Gareth Hughes <gareth@valinux.com>
  34   34   *
  35   35   */
  36   36  
  37   37  /*
  38   38   * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  39   39   * Use is subject to license terms.
  40   40   */
  41   41  
  42   42  /*
       43 + * Copyright 2014 RackTop Systems.
       44 + */
       45 +
       46 +/*
  43   47   * I915 DRM Driver for Solaris
  44   48   *
  45   49   * This driver provides the hardware 3D acceleration support for Intel
  46   50   * integrated video devices (e.g. i8xx/i915/i945 series chipsets), under the
  47   51   * DRI (Direct Rendering Infrastructure). DRM (Direct Rendering Manager) here
  48   52   * means the kernel device driver in DRI.
  49   53   *
  50   54   * I915 driver is a device dependent driver only, it depends on a misc module
  51   55   * named drm for generic DRM operations.
  52   56   */
↓ open down ↓ 648 lines elided ↑ open up ↑
 701  705          S3_WRITE (CG_2D_DIS, s3_priv->saveCG_2D_DIS);
 702  706  
 703  707          /* Cache mode state */
 704  708          S3_WRITE (CACHE_MODE_0, s3_priv->saveCACHE_MODE_0 | 0xffff0000);
 705  709  
 706  710          /* Memory arbitration state */
 707  711          S3_WRITE (MI_ARB_STATE, s3_priv->saveMI_ARB_STATE | 0xffff0000);
 708  712          
 709  713          for (i = 0; i < 16; i++) {
 710  714                  S3_WRITE(SWF0 + (i << 2), s3_priv->saveSWF0[i]);
 711      -                S3_WRITE(SWF10 + (i << 2), s3_priv->saveSWF1[i+7]);
      715 +                S3_WRITE(SWF10 + (i << 2), s3_priv->saveSWF1[i]);
 712  716          }
 713  717          for (i = 0; i < 3; i++)
 714  718                  S3_WRITE(SWF30 + (i << 2), s3_priv->saveSWF2[i]);
 715  719  
 716  720          S3_WRITE(I915REG_PGTBL_CTRL, s3_priv->pgtbl_ctl);
 717  721  
 718  722          (void) pci_config_teardown(&conf_hdl);
 719  723  
 720  724          drm_agp_rebind(dev);
 721  725  
↓ open down ↓ 322 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX