kill DRM_VERIFYAREA_READ, it's part of a linux optimisation where we can

guarrantee that copyin won't pagefault and use a faster version in that
case.

Since we just use plain copyin, it's stupid.

4 files changed, 14 insertions, 43 deletions

diff --git a/sys/dev/pci/drm/drmP.h b/sys/dev/pci/drm/drmP.h
index 6e9b3345f77..734f0741188 100644
--- a/sys/dev/pci/drm/drmP.h
+++ b/sys/dev/pci/drm/drmP.h
@@ -85,7 +85,7 @@
 #define DRM_CURRENTPID		curproc->p_pid
 #define DRM_LOCK()		rw_enter_write(&dev->dev_lock)
 #define DRM_UNLOCK()		rw_exit_write(&dev->dev_lock)
-#define DRM_MAXUNITS	8
+#define DRM_MAXUNITS		8
 
 /* D_CLONE only supports one device, this will be fixed eventually */
 #define drm_get_device_from_kdev(_kdev)	\
@@ -130,20 +130,8 @@ typedef u_int8_t u8;
 					"lock; addl $0,0(%%rsp)" : : : "memory");
 #endif
 
-#define DRM_VERIFYAREA_READ( uaddr, size )				\
-	(!uvm_map_checkprot(&(curproc->p_vmspace->vm_map),		\
-	    (vaddr_t)uaddr, (vaddr_t)uaddr+size, UVM_PROT_READ))
-
-#define DRM_COPY_TO_USER(user, kern, size) \
-	copyout(kern, user, size)
-#define DRM_COPY_FROM_USER(kern, user, size) \
-	copyin(user, kern, size)
-#define DRM_COPY_FROM_USER_UNCHECKED(arg1, arg2, arg3) 	\
-	copyin(arg2, arg1, arg3)
-#define DRM_COPY_TO_USER_UNCHECKED(arg1, arg2, arg3)	\
-	copyout(arg2, arg1, arg3)
-#define DRM_GET_USER_UNCHECKED(val, uaddr)		\
-	((val) = fuword(uaddr), 0)
+#define	DRM_COPY_TO_USER(user, kern, size)	copyout(kern, user, size)
+#define	DRM_COPY_FROM_USER(kern, user, size)	copyin(user, kern, size)
 #define le32_to_cpu(x) letoh32(x)
 #define cpu_to_le32(x) htole32(x)
 
diff --git a/sys/dev/pci/drm/i915_dma.c b/sys/dev/pci/drm/i915_dma.c
index f426c493e6c..0133277d755 100644
--- a/sys/dev/pci/drm/i915_dma.c
+++ b/sys/dev/pci/drm/i915_dma.c
@@ -274,7 +274,7 @@ static int i915_emit_cmds(struct drm_device *dev, int __user *buffer,
 	for (i = 0; i < dwords;) {
 		int cmd, sz;
 
-		if (DRM_COPY_FROM_USER_UNCHECKED(&cmd, &buffer[i], sizeof(cmd)))
+		if (DRM_COPY_FROM_USER(&cmd, &buffer[i], sizeof(cmd)))
 			return EINVAL;
 
 		if ((sz = validate_cmd(cmd)) == 0 || i + sz > dwords)
@@ -283,8 +283,7 @@ static int i915_emit_cmds(struct drm_device *dev, int __user *buffer,
 		OUT_RING(cmd);
 
 		while (++i, --sz) {
-			if (DRM_COPY_FROM_USER_UNCHECKED(&cmd, &buffer[i],
-							 sizeof(cmd))) {
+			if (DRM_COPY_FROM_USER(&cmd, &buffer[i], sizeof(cmd))) {
 				return EINVAL;
 			}
 			OUT_RING(cmd);
@@ -299,20 +298,21 @@ static int i915_emit_cmds(struct drm_device *dev, int __user *buffer,
 	return 0;
 }
 
-static int i915_emit_box(struct drm_device * dev,
-			 struct drm_clip_rect __user * boxes,
-			 int i, int DR1, int DR4)
+static int
+i915_emit_box(struct drm_device * dev, struct drm_clip_rect *boxes,
+    int i, int DR1, int DR4)
 {
 	drm_i915_private_t *dev_priv = dev->dev_private;
 	struct drm_clip_rect box;
 
-	if (DRM_COPY_FROM_USER_UNCHECKED(&box, &boxes[i], sizeof(box))) {
+	if (DRM_COPY_FROM_USER(&box, &boxes[i], sizeof(box))) {
 		return EFAULT;
 	}
 
-	if (box.y2 <= box.y1 || box.x2 <= box.x1 || box.y2 <= 0 || box.x2 <= 0) {
+	if (box.y2 <= box.y1 || box.x2 <= box.x1 || box.y2 <= 0 ||
+	    box.x2 <= 0) {
 		DRM_ERROR("Bad box %d,%d..%d,%d\n",
-			  box.x1, box.y1, box.x2, box.y2);
+		    box.x1, box.y1, box.x2, box.y2);
 		return EINVAL;
 	}
 
@@ -480,10 +480,6 @@ int i915_batchbuffer(struct drm_device *dev, void *data,
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-	if (batch->num_cliprects && DRM_VERIFYAREA_READ(batch->cliprects,
-	    batch->num_cliprects * sizeof(struct drm_clip_rect)))
-		return EFAULT;
-
 	DRM_LOCK();
 	ret = i915_dispatch_batchbuffer(dev, batch);
 	DRM_UNLOCK();
@@ -508,14 +504,6 @@ int i915_cmdbuffer(struct drm_device *dev, void *data,
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-	if (cmdbuf->num_cliprects &&
-	    DRM_VERIFYAREA_READ(cmdbuf->cliprects,
-				cmdbuf->num_cliprects *
-				sizeof(struct drm_clip_rect))) {
-		DRM_ERROR("Fault accessing cliprects\n");
-		return EFAULT;
-	}
-
 	DRM_LOCK();
 	ret = i915_dispatch_cmdbuffer(dev, cmdbuf);
 	DRM_UNLOCK();
diff --git a/sys/dev/pci/drm/r300_cmdbuf.c b/sys/dev/pci/drm/r300_cmdbuf.c
index 7bd46d0ee01..6f5d7be1636 100644
--- a/sys/dev/pci/drm/r300_cmdbuf.c
+++ b/sys/dev/pci/drm/r300_cmdbuf.c
@@ -99,8 +99,8 @@ r300_emit_cliprects(drm_radeon_private_t *dev_priv,
 		OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
 
 		for (i = 0; i < nr; ++i) {
-			if (DRM_COPY_FROM_USER_UNCHECKED
-			    (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
+			if (DRM_COPY_FROM_USER(&box, &cmdbuf->boxes[n + i],
+			    sizeof(box))) {
 				DRM_ERROR("copy cliprect faulted\n");
 				return EFAULT;
 			}
diff --git a/sys/dev/pci/drm/savage_state.c b/sys/dev/pci/drm/savage_state.c
index 25e1aeb6005..39aa9183abc 100644
--- a/sys/dev/pci/drm/savage_state.c
+++ b/sys/dev/pci/drm/savage_state.c
@@ -981,11 +981,6 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
 		dmabuf = NULL;
 	}
 
-	/* Copy the user buffers into kernel temporary areas.  This hasn't been
-	 * a performance loss compared to VERIFYAREA_READ/
-	 * COPY_FROM_USER_UNCHECKED when done in other drivers, and is correct
-	 * for locking on FreeBSD.
-	 */
 	if (cmdbuf->size) {
 		kcmd_addr = drm_calloc(cmdbuf->size, 8);
 		if (kcmd_addr == NULL)