From owner-freebsd-multimedia  Fri Mar 21 14:14:39 1997
Return-Path: <owner-multimedia>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id OAA16737
          for multimedia-outgoing; Fri, 21 Mar 1997 14:14:39 -0800 (PST)
Received: from Ilsa.StevesCafe.com (sc-gw.StevesCafe.com [205.168.119.191])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id OAA16720
          for <multimedia@freebsd.org>; Fri, 21 Mar 1997 14:14:29 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by Ilsa.StevesCafe.com (8.7.5/8.6.12) with SMTP id PAA25609; Fri, 21 Mar 1997 15:14:06 -0700 (MST)
Message-Id: <199703212214.PAA25609@Ilsa.StevesCafe.com>
X-Authentication-Warning: Ilsa.StevesCafe.com: Host localhost [127.0.0.1] didn't use HELO protocol
X-Mailer: exmh version 1.6.5 12/11/95
From: Steve Passe <smp@csn.net>
To: Amancio Hasty <hasty@rah.star-gate.com>
cc: "Louis A. Mamakos" <louie@TransSys.COM>,
        Michael Petry <petry@netwolf.NetMasters.com>, multimedia@freebsd.org
Subject: Re: Continquous Memory vs Virtual Memory 
In-reply-to: Your message of "Fri, 21 Mar 1997 13:48:51 PST."
             <199703212148.NAA02123@rah.star-gate.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 21 Mar 1997 15:14:06 -0700
Sender: owner-multimedia@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Hi,

> Nope, because the risc program is build in a allocated area in 
> the kernel which the user can't override. If someone wanted
                                            ^^^^^^^^^^^^^^^^^
> to over-write a particular region of memory with the output
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> of the bt848 , they can .
  ^^^^^^^^^^^^^^^^^^^^^^^^^

this is the possibility that I was refering to.  thus they could do the
same thing that people do with strcpy(), write a short segment of
code that creates a "worm hole" into the kernel, then install it
with the above technique.  this says to me that allowing a user
to create and load a RISC program is a BAD idea.  But having the
kernel level RISC compiler is a good idea.  It could enforce that the
destination address MUST be within the range of the video card's
linear buffer.  Now we still need to worry about source addresses,
a clever programmer could write a "snoop" program that
could look into kernel core for other hacking info...

--
Steve Passe	| powered by
smp@csn.net	|            Symmetric MultiProcessor FreeBSD