diff options
Diffstat (limited to 'shared')
| -rw-r--r-- | shared/drm.h | 30 | ||||
| -rw-r--r-- | shared/i915_dma.c | 22 | ||||
| -rw-r--r-- | shared/i915_drm.h | 12 | ||||
| -rw-r--r-- | shared/i915_irq.c | 4 | ||||
| -rw-r--r-- | shared/i915_mem.c | 6 | ||||
| -rw-r--r-- | shared/mga_dma.c | 9 | ||||
| -rw-r--r-- | shared/mga_drm.h | 2 | ||||
| -rw-r--r-- | shared/mga_state.c | 12 | ||||
| -rw-r--r-- | shared/r128_cce.c | 9 | ||||
| -rw-r--r-- | shared/r128_drm.h | 12 | ||||
| -rw-r--r-- | shared/r128_state.c | 16 | ||||
| -rw-r--r-- | shared/radeon_cp.c | 9 | ||||
| -rw-r--r-- | shared/radeon_drm.h | 22 | ||||
| -rw-r--r-- | shared/radeon_drv.h | 2 | ||||
| -rw-r--r-- | shared/radeon_irq.c | 4 | ||||
| -rw-r--r-- | shared/radeon_mem.c | 6 | ||||
| -rw-r--r-- | shared/radeon_state.c | 53 | ||||
| -rw-r--r-- | shared/sis_mm.c | 25 |
18 files changed, 131 insertions, 124 deletions
diff --git a/shared/drm.h b/shared/drm.h index 84e97fa2..ce51dfc1 100644 --- a/shared/drm.h +++ b/shared/drm.h @@ -174,11 +174,11 @@ typedef struct drm_version { int version_minor; /**< Minor version */ int version_patchlevel;/**< Patch level */ DRM_SIZE_T name_len; /**< Length of name buffer */ - char *name; /**< Name of driver */ + char __user *name; /**< Name of driver */ DRM_SIZE_T date_len; /**< Length of date buffer */ - char *date; /**< User-space buffer to hold date */ + char __user *date; /**< User-space buffer to hold date */ DRM_SIZE_T desc_len; /**< Length of desc buffer */ - char *desc; /**< User-space buffer to hold desc */ + char __user *desc; /**< User-space buffer to hold desc */ } drm_version_t; @@ -189,14 +189,14 @@ typedef struct drm_version { */ typedef struct drm_unique { DRM_SIZE_T unique_len; /**< Length of unique */ - char *unique; /**< Unique name for driver instantiation */ + char __user *unique; /**< Unique name for driver instantiation */ } drm_unique_t; #undef DRM_SIZE_T typedef struct drm_list { int count; /**< Length of user-space structures */ - drm_version_t *version; + drm_version_t __user *version; } drm_list_t; @@ -402,7 +402,7 @@ typedef struct drm_buf_desc { */ typedef struct drm_buf_info { int count; /**< Number of buffers described in list */ - drm_buf_desc_t *list; /**< List of buffer descriptions */ + drm_buf_desc_t __user *list; /**< List of buffer descriptions */ } drm_buf_info_t; @@ -411,7 +411,7 @@ typedef struct drm_buf_info { */ typedef struct drm_buf_free { int count; - int *list; + int __user *list; } drm_buf_free_t; @@ -424,7 +424,7 @@ typedef struct drm_buf_pub { int idx; /**< Index into the master buffer list */ int total; /**< Buffer size */ int used; /**< Amount of buffer in use (for DMA) */ - void *address; /**< Address of buffer */ + void __user *address; /**< Address of buffer */ } drm_buf_pub_t; @@ -433,8 +433,8 @@ typedef struct drm_buf_pub { */ typedef struct drm_buf_map { int count; /**< Length of the buffer list */ - void *virtual; /**< Mmap'd area in user-virtual */ - drm_buf_pub_t *list; /**< Buffer information */ + void __user *virtual; /**< Mmap'd area in user-virtual */ + drm_buf_pub_t __user *list; /**< Buffer information */ } drm_buf_map_t; @@ -448,13 +448,13 @@ typedef struct drm_buf_map { typedef struct drm_dma { int context; /**< Context handle */ int send_count; /**< Number of buffers to send */ - int *send_indices; /**< List of handles to buffers */ - int *send_sizes; /**< Lengths of data to send */ + int __user *send_indices; /**< List of handles to buffers */ + int __user *send_sizes; /**< Lengths of data to send */ drm_dma_flags_t flags; /**< Flags */ int request_count; /**< Number of buffers requested */ int request_size; /**< Desired size for buffers */ - int *request_indices; /**< Buffer information */ - int *request_sizes; + int __user *request_indices; /**< Buffer information */ + int __user *request_sizes; int granted_count; /**< Number of buffers granted */ } drm_dma_t; @@ -481,7 +481,7 @@ typedef struct drm_ctx { */ typedef struct drm_ctx_res { int count; - drm_ctx_t *contexts; + drm_ctx_t __user *contexts; } drm_ctx_res_t; diff --git a/shared/i915_dma.c b/shared/i915_dma.c index 6d85e050..d1a441e7 100644 --- a/shared/i915_dma.c +++ b/shared/i915_dma.c @@ -15,7 +15,7 @@ #include "i915_drv.h" -static void i915_print_status_page(drm_device_t *dev) +static inline void i915_print_status_page(drm_device_t *dev) { drm_i915_private_t *dev_priv = dev->dev_private; u32 *temp = dev_priv->hw_status_page; @@ -246,7 +246,7 @@ int i915_dma_init( DRM_IOCTL_ARGS ) drm_i915_init_t init; int retcode = 0; - DRM_COPY_FROM_USER_IOCTL( init, (drm_i915_init_t *)data, sizeof(init)); + DRM_COPY_FROM_USER_IOCTL( init, (drm_i915_init_t __user *)data, sizeof(init)); switch(init.func) { case I915_INIT_DMA: @@ -351,7 +351,7 @@ static int validate_cmd( int cmd ) static int i915_emit_cmds( drm_device_t *dev, - int *buffer, + int __user *buffer, int dwords ) { drm_i915_private_t *dev_priv = dev->dev_private; @@ -386,7 +386,7 @@ static int i915_emit_cmds( drm_device_t *dev, } static int i915_emit_box( drm_device_t *dev, - drm_clip_rect_t *boxes, + drm_clip_rect_t __user *boxes, int i, int DR1, int DR4) @@ -425,10 +425,8 @@ static int i915_emit_box( drm_device_t *dev, static int i915_dispatch_cmdbuffer(drm_device_t *dev, drm_i915_cmdbuffer_t *cmd ) { - drm_i915_private_t *dev_priv = dev->dev_private; int nbox = cmd->num_cliprects; int i = 0, count, ret; - RING_LOCALS; if (cmd->sz & 0x3) { DRM_ERROR("alignment"); @@ -447,7 +445,7 @@ static int i915_dispatch_cmdbuffer(drm_device_t *dev, return ret; } - ret = i915_emit_cmds( dev, (int *)cmd->buf, cmd->sz / 4 ); + ret = i915_emit_cmds( dev, (int __user *)cmd->buf, cmd->sz / 4 ); if (ret) return ret; } @@ -462,7 +460,7 @@ static int i915_dispatch_batchbuffer(drm_device_t *dev, drm_i915_batchbuffer_t *batch ) { drm_i915_private_t *dev_priv = dev->dev_private; - drm_clip_rect_t box, *boxes = batch->cliprects; + drm_clip_rect_t *boxes = batch->cliprects; int nbox = batch->num_cliprects; int i = 0, count; RING_LOCALS; @@ -602,7 +600,7 @@ int i915_batchbuffer( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( batch, (drm_i915_batchbuffer_t *)data, + DRM_COPY_FROM_USER_IOCTL( batch, (drm_i915_batchbuffer_t __user *)data, sizeof(batch) ); DRM_DEBUG("i915 batchbuffer, start %x used %d cliprects %d\n", @@ -635,7 +633,7 @@ int i915_cmdbuffer( DRM_IOCTL_ARGS ) drm_i915_cmdbuffer_t cmdbuf; int ret; - DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_i915_cmdbuffer_t *)data, + DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_i915_cmdbuffer_t __user *)data, sizeof(cmdbuf) ); DRM_DEBUG("i915 cmdbuffer, buf %p sz %d cliprects %d\n", @@ -705,7 +703,7 @@ int i915_getparam( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL(param, (drm_i915_getparam_t *)data, + DRM_COPY_FROM_USER_IOCTL(param, (drm_i915_getparam_t __user *)data, sizeof(param)); switch( param.param ) { @@ -740,7 +738,7 @@ int i915_setparam( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( param, (drm_i915_setparam_t *)data, + DRM_COPY_FROM_USER_IOCTL( param, (drm_i915_setparam_t __user *)data, sizeof(param) ); switch( param.param ) { diff --git a/shared/i915_drm.h b/shared/i915_drm.h index 707e553c..7a69e83f 100644 --- a/shared/i915_drm.h +++ b/shared/i915_drm.h @@ -87,26 +87,26 @@ typedef struct _drm_i915_batchbuffer { int DR1; /* hw flags for GFX_OP_DRAWRECT_INFO */ int DR4; /* window origin for GFX_OP_DRAWRECT_INFO*/ int num_cliprects; /* mulitpass with multiple cliprects? */ - drm_clip_rect_t *cliprects; /* pointer to userspace cliprects */ + drm_clip_rect_t __user *cliprects; /* pointer to userspace cliprects */ } drm_i915_batchbuffer_t; /* As above, but pass a pointer to userspace buffer which can be * validated by the kernel prior to sending to hardware. */ typedef struct _drm_i915_cmdbuffer { - char *buf; /* pointer to userspace command buffer */ + char __user *buf; /* pointer to userspace command buffer */ int sz; /* nr bytes in buf */ int DR1; /* hw flags for GFX_OP_DRAWRECT_INFO */ int DR4; /* window origin for GFX_OP_DRAWRECT_INFO*/ int num_cliprects; /* mulitpass with multiple cliprects? */ - drm_clip_rect_t *cliprects; /* pointer to userspace cliprects */ + drm_clip_rect_t __user *cliprects; /* pointer to userspace cliprects */ } drm_i915_cmdbuffer_t; /* Userspace can request & wait on irq's: */ typedef struct drm_i915_irq_emit { - int *irq_seq; + int __user *irq_seq; } drm_i915_irq_emit_t; typedef struct drm_i915_irq_wait { @@ -121,7 +121,7 @@ typedef struct drm_i915_irq_wait { typedef struct drm_i915_getparam { int param; - int *value; + int __user *value; } drm_i915_getparam_t; @@ -144,7 +144,7 @@ typedef struct drm_i915_mem_alloc { int region; int alignment; int size; - int *region_offset; /* offset from start of fb or agp */ + int __user *region_offset; /* offset from start of fb or agp */ } drm_i915_mem_alloc_t; typedef struct drm_i915_mem_free { diff --git a/shared/i915_irq.c b/shared/i915_irq.c index f9d5d4b7..e37da827 100644 --- a/shared/i915_irq.c +++ b/shared/i915_irq.c @@ -108,7 +108,7 @@ int i915_irq_emit( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( emit, (drm_i915_irq_emit_t *)data, + DRM_COPY_FROM_USER_IOCTL( emit, (drm_i915_irq_emit_t __user *)data, sizeof(emit) ); result = i915_emit_irq( dev ); @@ -135,7 +135,7 @@ int i915_irq_wait( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_i915_irq_wait_t *)data, + DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_i915_irq_wait_t __user *)data, sizeof(irqwait) ); return i915_wait_irq( dev, irqwait.irq_seq ); diff --git a/shared/i915_mem.c b/shared/i915_mem.c index 0e413d47..2a2379d0 100644 --- a/shared/i915_mem.c +++ b/shared/i915_mem.c @@ -268,7 +268,7 @@ int i915_mem_alloc( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( alloc, (drm_i915_mem_alloc_t *)data, + DRM_COPY_FROM_USER_IOCTL( alloc, (drm_i915_mem_alloc_t __user *)data, sizeof(alloc) ); heap = get_heap( dev_priv, alloc.region ); @@ -312,7 +312,7 @@ int i915_mem_free( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( memfree, (drm_i915_mem_free_t *)data, + DRM_COPY_FROM_USER_IOCTL( memfree, (drm_i915_mem_free_t __user *)data, sizeof(memfree) ); heap = get_heap( dev_priv, memfree.region ); @@ -343,7 +343,7 @@ int i915_mem_init_heap( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( initheap, (drm_i915_mem_init_heap_t *)data, + DRM_COPY_FROM_USER_IOCTL( initheap, (drm_i915_mem_init_heap_t __user *)data, sizeof(initheap) ); heap = get_heap( dev_priv, initheap.region ); diff --git a/shared/mga_dma.c b/shared/mga_dma.c index 5e5c407d..76fbf714 100644 --- a/shared/mga_dma.c +++ b/shared/mga_dma.c @@ -668,7 +668,7 @@ int mga_dma_init( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t *)data, sizeof(init) ); + DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t __user *)data, sizeof(init) ); switch ( init.func ) { case MGA_INIT_DMA: @@ -693,7 +693,7 @@ int mga_dma_flush( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( lock, (drm_lock_t *)data, sizeof(lock) ); + DRM_COPY_FROM_USER_IOCTL( lock, (drm_lock_t __user *)data, sizeof(lock) ); DRM_DEBUG( "%s%s%s\n", (lock.flags & _DRM_LOCK_FLUSH) ? "flush, " : "", @@ -764,12 +764,13 @@ int mga_dma_buffers( DRM_IOCTL_ARGS ) DRM_DEVICE; drm_device_dma_t *dma = dev->dma; drm_mga_private_t *dev_priv = (drm_mga_private_t *)dev->dev_private; + drm_dma_t __user *argp = (void __user *)data; drm_dma_t d; int ret = 0; LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *)data, sizeof(d) ); + DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) ); /* Please don't send us buffers. */ @@ -795,7 +796,7 @@ int mga_dma_buffers( DRM_IOCTL_ARGS ) ret = mga_dma_get_buffers( filp, dev, &d ); } - DRM_COPY_TO_USER_IOCTL( (drm_dma_t *)data, d, sizeof(d) ); + DRM_COPY_TO_USER_IOCTL( argp, d, sizeof(d) ); return ret; } diff --git a/shared/mga_drm.h b/shared/mga_drm.h index 98988906..521d4451 100644 --- a/shared/mga_drm.h +++ b/shared/mga_drm.h @@ -343,7 +343,7 @@ typedef struct _drm_mga_blit { typedef struct drm_mga_getparam { int param; - void *value; + void __user *value; } drm_mga_getparam_t; #endif diff --git a/shared/mga_state.c b/shared/mga_state.c index 256dd47d..43659825 100644 --- a/shared/mga_state.c +++ b/shared/mga_state.c @@ -889,7 +889,7 @@ int mga_dma_clear( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( clear, (drm_mga_clear_t *)data, sizeof(clear) ); + DRM_COPY_FROM_USER_IOCTL( clear, (drm_mga_clear_t __user *)data, sizeof(clear) ); if ( sarea_priv->nbox > MGA_NR_SAREA_CLIPRECTS ) sarea_priv->nbox = MGA_NR_SAREA_CLIPRECTS; @@ -939,7 +939,7 @@ int mga_dma_vertex( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); DRM_COPY_FROM_USER_IOCTL( vertex, - (drm_mga_vertex_t *)data, + (drm_mga_vertex_t __user *)data, sizeof(vertex) ); if(vertex.idx < 0 || vertex.idx > dma->buf_count) return DRM_ERR(EINVAL); @@ -978,7 +978,7 @@ int mga_dma_indices( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); DRM_COPY_FROM_USER_IOCTL( indices, - (drm_mga_indices_t *)data, + (drm_mga_indices_t __user *)data, sizeof(indices) ); if(indices.idx < 0 || indices.idx > dma->buf_count) return DRM_ERR(EINVAL); @@ -1017,7 +1017,7 @@ int mga_dma_iload( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( iload, (drm_mga_iload_t *)data, sizeof(iload) ); + DRM_COPY_FROM_USER_IOCTL( iload, (drm_mga_iload_t __user *)data, sizeof(iload) ); #if 0 if ( mga_do_wait_for_idle( dev_priv ) < 0 ) { @@ -1057,7 +1057,7 @@ int mga_dma_blit( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( blit, (drm_mga_blit_t *)data, sizeof(blit) ); + DRM_COPY_FROM_USER_IOCTL( blit, (drm_mga_blit_t __user *)data, sizeof(blit) ); if ( sarea_priv->nbox > MGA_NR_SAREA_CLIPRECTS ) sarea_priv->nbox = MGA_NR_SAREA_CLIPRECTS; @@ -1088,7 +1088,7 @@ int mga_getparam( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( param, (drm_mga_getparam_t *)data, + DRM_COPY_FROM_USER_IOCTL( param, (drm_mga_getparam_t __user *)data, sizeof(param) ); DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID ); diff --git a/shared/r128_cce.c b/shared/r128_cce.c index bf4b4d95..22d38b70 100644 --- a/shared/r128_cce.c +++ b/shared/r128_cce.c @@ -632,7 +632,7 @@ int r128_cce_init( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t *)data, sizeof(init) ); + DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t __user *)data, sizeof(init) ); switch ( init.func ) { case R128_INIT_CCE: @@ -675,7 +675,7 @@ int r128_cce_stop( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL(stop, (drm_r128_cce_stop_t *)data, sizeof(stop) ); + DRM_COPY_FROM_USER_IOCTL(stop, (drm_r128_cce_stop_t __user *)data, sizeof(stop) ); /* Flush any pending CCE commands. This ensures any outstanding * commands are exectuted by the engine before we turn it off. @@ -912,11 +912,12 @@ int r128_cce_buffers( DRM_IOCTL_ARGS ) DRM_DEVICE; drm_device_dma_t *dma = dev->dma; int ret = 0; + drm_dma_t __user *argp = (void __user *)data; drm_dma_t d; LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *) data, sizeof(d) ); + DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) ); /* Please don't send us buffers. */ @@ -940,7 +941,7 @@ int r128_cce_buffers( DRM_IOCTL_ARGS ) ret = r128_cce_get_buffers( filp, dev, &d ); } - DRM_COPY_TO_USER_IOCTL((drm_dma_t *) data, d, sizeof(d) ); + DRM_COPY_TO_USER_IOCTL(argp, d, sizeof(d) ); return ret; } diff --git a/shared/r128_drm.h b/shared/r128_drm.h index ae51de34..0cba17d1 100644 --- a/shared/r128_drm.h +++ b/shared/r128_drm.h @@ -308,14 +308,14 @@ typedef struct drm_r128_depth { R128_READ_PIXELS = 0x04 } func; int n; - int *x; - int *y; - unsigned int *buffer; - unsigned char *mask; + int __user *x; + int __user *y; + unsigned int __user *buffer; + unsigned char __user *mask; } drm_r128_depth_t; typedef struct drm_r128_stipple { - unsigned int *mask; + unsigned int __user *mask; } drm_r128_stipple_t; typedef struct drm_r128_indirect { @@ -339,7 +339,7 @@ typedef struct drm_r128_fullscreen { typedef struct drm_r128_getparam { int param; - void *value; + void __user *value; } drm_r128_getparam_t; #endif diff --git a/shared/r128_state.c b/shared/r128_state.c index 6ec11b02..34ebcae1 100644 --- a/shared/r128_state.c +++ b/shared/r128_state.c @@ -1271,7 +1271,7 @@ int r128_cce_clear( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( clear, (drm_r128_clear_t *) data, + DRM_COPY_FROM_USER_IOCTL( clear, (drm_r128_clear_t __user *) data, sizeof(clear) ); RING_SPACE_TEST_WITH_RETURN( dev_priv ); @@ -1386,7 +1386,7 @@ int r128_cce_vertex( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( vertex, (drm_r128_vertex_t *) data, + DRM_COPY_FROM_USER_IOCTL( vertex, (drm_r128_vertex_t __user *) data, sizeof(vertex) ); DRM_DEBUG( "pid=%d index=%d count=%d discard=%d\n", @@ -1447,7 +1447,7 @@ int r128_cce_indices( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( elts, (drm_r128_indices_t *) data, + DRM_COPY_FROM_USER_IOCTL( elts, (drm_r128_indices_t __user *) data, sizeof(elts) ); DRM_DEBUG( "pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID, @@ -1512,7 +1512,7 @@ int r128_cce_blit( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( blit, (drm_r128_blit_t *) data, + DRM_COPY_FROM_USER_IOCTL( blit, (drm_r128_blit_t __user *) data, sizeof(blit) ); DRM_DEBUG( "pid=%d index=%d\n", DRM_CURRENTPID, blit.idx ); @@ -1541,7 +1541,7 @@ int r128_cce_depth( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( depth, (drm_r128_depth_t *) data, + DRM_COPY_FROM_USER_IOCTL( depth, (drm_r128_depth_t __user *) data, sizeof(depth) ); RING_SPACE_TEST_WITH_RETURN( dev_priv ); @@ -1571,7 +1571,7 @@ int r128_cce_stipple( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( stipple, (drm_r128_stipple_t *) data, + DRM_COPY_FROM_USER_IOCTL( stipple, (drm_r128_stipple_t __user *) data, sizeof(stipple) ); if ( DRM_COPY_FROM_USER( &mask, stipple.mask, @@ -1605,7 +1605,7 @@ int r128_cce_indirect( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( indirect, (drm_r128_indirect_t *) data, + DRM_COPY_FROM_USER_IOCTL( indirect, (drm_r128_indirect_t __user *) data, sizeof(indirect) ); DRM_DEBUG( "indirect: idx=%d s=%d e=%d d=%d\n", @@ -1674,7 +1674,7 @@ int r128_getparam( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( param, (drm_r128_getparam_t *)data, + DRM_COPY_FROM_USER_IOCTL( param, (drm_r128_getparam_t __user *)data, sizeof(param) ); DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID ); diff --git a/shared/radeon_cp.c b/shared/radeon_cp.c index e145c78e..f6964908 100644 --- a/shared/radeon_cp.c +++ b/shared/radeon_cp.c @@ -1358,7 +1358,7 @@ int radeon_cp_init( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t *)data, sizeof(init) ); + DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t __user *)data, sizeof(init) ); switch ( init.func ) { case RADEON_INIT_CP: @@ -1407,7 +1407,7 @@ int radeon_cp_stop( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( stop, (drm_radeon_cp_stop_t *)data, sizeof(stop) ); + DRM_COPY_FROM_USER_IOCTL( stop, (drm_radeon_cp_stop_t __user *)data, sizeof(stop) ); if (!dev_priv->cp_running) return 0; @@ -1712,11 +1712,12 @@ int radeon_cp_buffers( DRM_IOCTL_ARGS ) DRM_DEVICE; drm_device_dma_t *dma = dev->dma; int ret = 0; + drm_dma_t __user *argp = (void __user *)data; drm_dma_t d; LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *)data, sizeof(d) ); + DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) ); /* Please don't send us buffers. */ @@ -1740,7 +1741,7 @@ int radeon_cp_buffers( DRM_IOCTL_ARGS ) ret = radeon_cp_get_buffers( filp, dev, &d ); } - DRM_COPY_TO_USER_IOCTL( (drm_dma_t *)data, d, sizeof(d) ); + DRM_COPY_TO_USER_IOCTL( argp, d, sizeof(d) ); return ret; } diff --git a/shared/radeon_drm.h b/shared/radeon_drm.h index 735e04ef..e447308b 100644 --- a/shared/radeon_drm.h +++ b/shared/radeon_drm.h @@ -482,7 +482,7 @@ typedef struct drm_radeon_clear { unsigned int clear_depth; unsigned int color_mask; unsigned int depth_mask; /* misnamed field: should be stencil */ - drm_radeon_clear_rect_t *depth_boxes; + drm_radeon_clear_rect_t __user *depth_boxes; } drm_radeon_clear_t; typedef struct drm_radeon_vertex { @@ -508,9 +508,9 @@ typedef struct drm_radeon_vertex2 { int idx; /* Index of vertex buffer */ int discard; /* Client finished with buffer? */ int nr_states; - drm_radeon_state_t *state; + drm_radeon_state_t __user *state; int nr_prims; - drm_radeon_prim_t *prim; + drm_radeon_prim_t __user *prim; } drm_radeon_vertex2_t; /* v1.3 - obsoletes drm_radeon_vertex2 @@ -525,15 +525,15 @@ typedef struct drm_radeon_vertex2 { */ typedef struct drm_radeon_cmd_buffer { int bufsz; - char *buf; + char __user *buf; int nbox; - drm_clip_rect_t *boxes; + drm_clip_rect_t __user *boxes; } drm_radeon_cmd_buffer_t; typedef struct drm_radeon_tex_image { unsigned int x, y; /* Blit coordinates */ unsigned int width, height; - const void *data; + const void __user *data; } drm_radeon_tex_image_t; typedef struct drm_radeon_texture { @@ -542,11 +542,11 @@ typedef struct drm_radeon_texture { int format; int width; /* Texture image coordinates */ int height; - drm_radeon_tex_image_t *image; + drm_radeon_tex_image_t __user *image; } drm_radeon_texture_t; typedef struct drm_radeon_stipple { - unsigned int *mask; + unsigned int __user *mask; } drm_radeon_stipple_t; typedef struct drm_radeon_indirect { @@ -576,7 +576,7 @@ typedef struct drm_radeon_indirect { typedef struct drm_radeon_getparam { int param; - void *value; + void __user *value; } drm_radeon_getparam_t; /* 1.6: Set up a memory manager for regions of shared memory: @@ -588,7 +588,7 @@ typedef struct drm_radeon_mem_alloc { int region; int alignment; int size; - int *region_offset; /* offset from start of fb or GART */ + int __user *region_offset; /* offset from start of fb or GART */ } drm_radeon_mem_alloc_t; typedef struct drm_radeon_mem_free { @@ -606,7 +606,7 @@ typedef struct drm_radeon_mem_init_heap { /* 1.6: Userspace can request & wait on irq's: */ typedef struct drm_radeon_irq_emit { - int *irq_seq; + int __user *irq_seq; } drm_radeon_irq_emit_t; typedef struct drm_radeon_irq_wait { diff --git a/shared/radeon_drv.h b/shared/radeon_drv.h index 45eafd05..e24e0ec0 100644 --- a/shared/radeon_drv.h +++ b/shared/radeon_drv.h @@ -887,7 +887,7 @@ do { \ #define OUT_RING_USER_TABLE( tab, sz ) do { \ int _size = (sz); \ - int *_tab = (tab); \ + int __user *_tab = (tab); \ \ if (write + _size > mask) { \ int i = (mask+1) - write; \ diff --git a/shared/radeon_irq.c b/shared/radeon_irq.c index f503153a..51d19493 100644 --- a/shared/radeon_irq.c +++ b/shared/radeon_irq.c @@ -187,7 +187,7 @@ int radeon_irq_emit( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( emit, (drm_radeon_irq_emit_t *)data, + DRM_COPY_FROM_USER_IOCTL( emit, (drm_radeon_irq_emit_t __user *)data, sizeof(emit) ); result = radeon_emit_irq( dev ); @@ -214,7 +214,7 @@ int radeon_irq_wait( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_radeon_irq_wait_t *)data, + DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_radeon_irq_wait_t __user*)data, sizeof(irqwait) ); return radeon_wait_irq( dev, irqwait.irq_seq ); diff --git a/shared/radeon_mem.c b/shared/radeon_mem.c index 96b76ae0..28995740 100644 --- a/shared/radeon_mem.c +++ b/shared/radeon_mem.c @@ -233,7 +233,7 @@ int radeon_mem_alloc( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( alloc, (drm_radeon_mem_alloc_t *)data, + DRM_COPY_FROM_USER_IOCTL( alloc, (drm_radeon_mem_alloc_t __user *)data, sizeof(alloc) ); heap = get_heap( dev_priv, alloc.region ); @@ -275,7 +275,7 @@ int radeon_mem_free( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( memfree, (drm_radeon_mem_free_t *)data, + DRM_COPY_FROM_USER_IOCTL( memfree, (drm_radeon_mem_free_t __user *)data, sizeof(memfree) ); heap = get_heap( dev_priv, memfree.region ); @@ -305,7 +305,7 @@ int radeon_mem_init_heap( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( initheap, (drm_radeon_mem_init_heap_t *)data, + DRM_COPY_FROM_USER_IOCTL( initheap, (drm_radeon_mem_init_heap_t __user *)data, sizeof(initheap) ); heap = get_heap( dev_priv, initheap.region ); diff --git a/shared/radeon_state.c b/shared/radeon_state.c index 4d760e92..10a6629a 100644 --- a/shared/radeon_state.c +++ b/shared/radeon_state.c @@ -63,7 +63,7 @@ static __inline__ int radeon_check_and_fixup_offset( drm_radeon_private_t *dev_p static __inline__ int radeon_check_and_fixup_offset_user( drm_radeon_private_t *dev_priv, drm_file_t *filp_priv, - u32 *offset ) { + u32 __user *offset ) { u32 off; DRM_GET_USER_UNCHECKED( off, offset ); @@ -79,7 +79,7 @@ static __inline__ int radeon_check_and_fixup_offset_user( drm_radeon_private_t * static __inline__ int radeon_check_and_fixup_packets( drm_radeon_private_t *dev_priv, drm_file_t *filp_priv, int id, - u32 *data ) { + u32 __user *data ) { switch ( id ) { case RADEON_EMIT_PP_MISC: @@ -217,7 +217,8 @@ static __inline__ int radeon_check_and_fixup_packet3( drm_radeon_private_t *dev_ drm_file_t *filp_priv, drm_radeon_cmd_buffer_t *cmdbuf, unsigned int *cmdsz ) { - u32 tmp[4], *cmd = ( u32* )cmdbuf->buf; + u32 tmp[4]; + u32 __user *cmd = (u32 __user *)cmdbuf->buf; if ( DRM_COPY_FROM_USER_UNCHECKED( tmp, cmd, sizeof( tmp ) ) ) { DRM_ERROR( "Failed to copy data from user space\n" ); @@ -1339,7 +1340,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp, drm_buf_t *buf; u32 format; u32 *buffer; - const u8 *data; + const u8 __user *data; int size, dwords, tex_width, blit_width; u32 height; int i; @@ -1417,7 +1418,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp, * update them for a multi-pass texture blit. */ height = image->height; - data = (const u8 *)image->data; + data = (const u8 __user *)image->data; size = height * blit_width; @@ -1499,7 +1500,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp, /* Update the input parameters for next time */ image->y += height; image->height -= height; - image->data = (const u8 *)image->data + size; + image->data = (const u8 __user *)image->data + size; } while (image->height > 0); /* Flush the pixel cache after the blit completes. This ensures @@ -1550,7 +1551,7 @@ int radeon_cp_clear( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( clear, (drm_radeon_clear_t *)data, + DRM_COPY_FROM_USER_IOCTL( clear, (drm_radeon_clear_t __user *)data, sizeof(clear) ); RING_SPACE_TEST_WITH_RETURN( dev_priv ); @@ -1671,7 +1672,7 @@ int radeon_cp_vertex( DRM_IOCTL_ARGS ) DRM_GET_PRIV_WITH_RETURN( filp_priv, filp ); - DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex_t *)data, + DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex_t __user *)data, sizeof(vertex) ); DRM_DEBUG( "pid=%d index=%d count=%d discard=%d\n", @@ -1762,7 +1763,7 @@ int radeon_cp_indices( DRM_IOCTL_ARGS ) DRM_GET_PRIV_WITH_RETURN( filp_priv, filp ); - DRM_COPY_FROM_USER_IOCTL( elts, (drm_radeon_indices_t *)data, + DRM_COPY_FROM_USER_IOCTL( elts, (drm_radeon_indices_t __user *)data, sizeof(elts) ); DRM_DEBUG( "pid=%d index=%d start=%d end=%d discard=%d\n", @@ -1853,7 +1854,7 @@ int radeon_cp_texture( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( tex, (drm_radeon_texture_t *)data, sizeof(tex) ); + DRM_COPY_FROM_USER_IOCTL( tex, (drm_radeon_texture_t __user *)data, sizeof(tex) ); if ( tex.image == NULL ) { DRM_ERROR( "null texture image!\n" ); @@ -1861,7 +1862,7 @@ int radeon_cp_texture( DRM_IOCTL_ARGS ) } if ( DRM_COPY_FROM_USER( &image, - (drm_radeon_tex_image_t *)tex.image, + (drm_radeon_tex_image_t __user *)tex.image, sizeof(image) ) ) return DRM_ERR(EFAULT); @@ -1883,7 +1884,7 @@ int radeon_cp_stipple( DRM_IOCTL_ARGS ) LOCK_TEST_WITH_RETURN( dev, filp ); - DRM_COPY_FROM_USER_IOCTL( stipple, (drm_radeon_stipple_t *)data, + DRM_COPY_FROM_USER_IOCTL( stipple, (drm_radeon_stipple_t __user *)data, sizeof(stipple) ); if ( DRM_COPY_FROM_USER( &mask, stipple.mask, 32 * sizeof(u32) ) ) @@ -1913,7 +1914,7 @@ int radeon_cp_indirect( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( indirect, (drm_radeon_indirect_t *)data, + DRM_COPY_FROM_USER_IOCTL( indirect, (drm_radeon_indirect_t __user *)data, sizeof(indirect) ); DRM_DEBUG( "indirect: idx=%d s=%d e=%d d=%d\n", @@ -1993,7 +1994,7 @@ int radeon_cp_vertex2( DRM_IOCTL_ARGS ) DRM_GET_PRIV_WITH_RETURN( filp_priv, filp ); - DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex2_t *)data, + DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex2_t __user *)data, sizeof(vertex) ); DRM_DEBUG( "pid=%d index=%d discard=%d\n", @@ -2086,7 +2087,7 @@ static int radeon_emit_packets( { int id = (int)header.packet.packet_id; int sz, reg; - int *data = (int *)cmdbuf->buf; + int __user *data = (int __user *)cmdbuf->buf; RING_LOCALS; if (id >= RADEON_MAX_STATE_PACKETS) @@ -2121,7 +2122,7 @@ static __inline__ int radeon_emit_scalars( drm_radeon_cmd_buffer_t *cmdbuf ) { int sz = header.scalars.count; - int *data = (int *)cmdbuf->buf; + int __user *data = (int __user *)cmdbuf->buf; int start = header.scalars.offset; int stride = header.scalars.stride; RING_LOCALS; @@ -2145,7 +2146,7 @@ static __inline__ int radeon_emit_scalars2( drm_radeon_cmd_buffer_t *cmdbuf ) { int sz = header.scalars.count; - int *data = (int *)cmdbuf->buf; + int __user *data = (int __user *)cmdbuf->buf; int start = ((unsigned int)header.scalars.offset) + 0x100; int stride = header.scalars.stride; RING_LOCALS; @@ -2167,7 +2168,7 @@ static __inline__ int radeon_emit_vectors( drm_radeon_cmd_buffer_t *cmdbuf ) { int sz = header.vectors.count; - int *data = (int *)cmdbuf->buf; + int __user *data = (int __user *)cmdbuf->buf; int start = header.vectors.offset; int stride = header.vectors.stride; RING_LOCALS; @@ -2191,7 +2192,8 @@ static int radeon_emit_packet3( drm_device_t *dev, { drm_radeon_private_t *dev_priv = dev->dev_private; unsigned int cmdsz; - int *cmd = (int *)cmdbuf->buf, ret; + int __user *cmd = (int __user *)cmdbuf->buf; + int ret; RING_LOCALS; DRM_DEBUG("\n"); @@ -2220,8 +2222,9 @@ static int radeon_emit_packet3_cliprect( drm_device_t *dev, drm_radeon_private_t *dev_priv = dev->dev_private; drm_clip_rect_t box; unsigned int cmdsz; - int *cmd = (int *)cmdbuf->buf, ret; - drm_clip_rect_t *boxes = cmdbuf->boxes; + int __user *cmd = (int __user *)cmdbuf->buf; + int ret; + drm_clip_rect_t __user *boxes = cmdbuf->boxes; int i = 0; RING_LOCALS; @@ -2325,7 +2328,7 @@ int radeon_cp_cmdbuf( DRM_IOCTL_ARGS ) DRM_GET_PRIV_WITH_RETURN( filp_priv, filp ); - DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_radeon_cmd_buffer_t *)data, + DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_radeon_cmd_buffer_t __user *)data, sizeof(cmdbuf) ); RING_SPACE_TEST_WITH_RETURN( dev_priv ); @@ -2344,7 +2347,7 @@ int radeon_cp_cmdbuf( DRM_IOCTL_ARGS ) while ( cmdbuf.bufsz >= sizeof(header) ) { - if (DRM_GET_USER_UNCHECKED( header.i, (int *)cmdbuf.buf )) { + if (DRM_GET_USER_UNCHECKED( header.i, (int __user *)cmdbuf.buf )) { DRM_ERROR("__get_user %p\n", cmdbuf.buf); return DRM_ERR(EFAULT); } @@ -2455,7 +2458,7 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS ) return DRM_ERR(EINVAL); } - DRM_COPY_FROM_USER_IOCTL( param, (drm_radeon_getparam_t *)data, + DRM_COPY_FROM_USER_IOCTL( param, (drm_radeon_getparam_t __user *)data, sizeof(param) ); DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID ); @@ -2530,7 +2533,7 @@ int radeon_cp_setparam( DRM_IOCTL_ARGS ) { DRM_GET_PRIV_WITH_RETURN( filp_priv, filp ); - DRM_COPY_FROM_USER_IOCTL( sp, ( drm_radeon_setparam_t* )data, + DRM_COPY_FROM_USER_IOCTL( sp, ( drm_radeon_setparam_t __user * )data, sizeof( sp ) ); switch( sp.param ) { diff --git a/shared/sis_mm.c b/shared/sis_mm.c index 7b10db97..9b6311a9 100644 --- a/shared/sis_mm.c +++ b/shared/sis_mm.c @@ -94,9 +94,10 @@ int sis_fb_alloc( DRM_IOCTL_ARGS ) { drm_sis_mem_t fb; struct sis_memreq req; + drm_sis_mem_t __user *argp = (void __user *)data; int retval = 0; - DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb)); + DRM_COPY_FROM_USER_IOCTL(fb, argp, sizeof(fb)); req.size = fb.size; sis_malloc(&req); @@ -115,7 +116,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS ) fb.free = 0; } - DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, fb, sizeof(fb)); + DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb)); DRM_DEBUG("alloc fb, size = %d, offset = %ld\n", fb.size, req.offset); @@ -127,7 +128,7 @@ int sis_fb_free( DRM_IOCTL_ARGS ) drm_sis_mem_t fb; int retval = 0; - DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb)); + DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t __user *)data, sizeof(fb)); if (!fb.free) return DRM_ERR(EINVAL); @@ -159,7 +160,7 @@ int sis_fb_init( DRM_IOCTL_ARGS ) drm_sis_private_t *dev_priv = dev->dev_private; drm_sis_fb_t fb; - DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_fb_t *)data, sizeof(fb)); + DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_fb_t __user *)data, sizeof(fb)); if (dev_priv == NULL) { dev->dev_private = DRM(calloc)(1, sizeof(drm_sis_private_t), @@ -183,6 +184,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS ) { DRM_DEVICE; drm_sis_private_t *dev_priv = dev->dev_private; + drm_sis_mem_t __user *argp = (void __user *)data; drm_sis_mem_t fb; PMemBlock block; int retval = 0; @@ -190,7 +192,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS ) if (dev_priv == NULL || dev_priv->FBHeap == NULL) return DRM_ERR(EINVAL); - DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb)); + DRM_COPY_FROM_USER_IOCTL(fb, argp, sizeof(fb)); block = mmAllocMem(dev_priv->FBHeap, fb.size, 0, 0); if (block) { @@ -208,7 +210,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS ) fb.free = 0; } - DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, fb, sizeof(fb)); + DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb)); DRM_DEBUG("alloc fb, size = %d, offset = %d\n", fb.size, fb.offset); @@ -224,7 +226,7 @@ int sis_fb_free( DRM_IOCTL_ARGS ) if (dev_priv == NULL || dev_priv->FBHeap == NULL) return DRM_ERR(EINVAL); - DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb)); + DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t __user *)data, sizeof(fb)); if (!mmBlockInHeap(dev_priv->FBHeap, (PMemBlock)fb.free)) return DRM_ERR(EINVAL); @@ -259,7 +261,7 @@ int sis_ioctl_agp_init( DRM_IOCTL_ARGS ) if (dev_priv->AGPHeap != NULL) return DRM_ERR(EINVAL); - DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_agp_t *)data, sizeof(agp)); + DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_agp_t __user *)data, sizeof(agp)); dev_priv->AGPHeap = mmInit(agp.offset, agp.size); @@ -272,6 +274,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS ) { DRM_DEVICE; drm_sis_private_t *dev_priv = dev->dev_private; + drm_sis_mem_t __user *argp = (void __user *)data; drm_sis_mem_t agp; PMemBlock block; int retval = 0; @@ -279,7 +282,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS ) if (dev_priv == NULL || dev_priv->AGPHeap == NULL) return DRM_ERR(EINVAL); - DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t *)data, sizeof(agp)); + DRM_COPY_FROM_USER_IOCTL(agp, argp, sizeof(agp)); block = mmAllocMem(dev_priv->AGPHeap, agp.size, 0, 0); if (block) { @@ -297,7 +300,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS ) agp.free = 0; } - DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, agp, sizeof(agp)); + DRM_COPY_TO_USER_IOCTL(argp, agp, sizeof(agp)); DRM_DEBUG("alloc agp, size = %d, offset = %d\n", agp.size, agp.offset); @@ -313,7 +316,7 @@ int sis_ioctl_agp_free( DRM_IOCTL_ARGS ) if (dev_priv == NULL || dev_priv->AGPHeap == NULL) return DRM_ERR(EINVAL); - DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t *)data, sizeof(agp)); + DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t __user *)data, sizeof(agp)); if (!mmBlockInHeap(dev_priv->AGPHeap, (PMemBlock)agp.free)) return DRM_ERR(EINVAL); |