[PATCH] annotations and NULL noise removal in drivers/char/drm

Massive, but trivial - drm annotated and got 0->NULL where needed.  That
patch kills ~2200 lines of warnings - out of 5400 that remained at that
point.

drivers/char/drm/drm.h

@@ -153,11 +153,11 @@ typedef struct drm_version {
 	int    version_minor;	  /**< Minor version */
 	int    version_patchlevel;/**< Patch level */
 	size_t name_len;	  /**< Length of name buffer */
-	char   *name;		  /**< Name of driver */
+	char   __user *name;	  /**< Name of driver */
 	size_t date_len;	  /**< Length of date buffer */
-	char   *date;		  /**< User-space buffer to hold date */
+	char   __user *date;	  /**< User-space buffer to hold date */
 	size_t desc_len;	  /**< Length of desc buffer */
-	char   *desc;		  /**< User-space buffer to hold desc */
+	char   __user *desc;	  /**< User-space buffer to hold desc */
 } drm_version_t;
 
 
@@ -168,13 +168,13 @@ typedef struct drm_version {
  */
 typedef struct drm_unique {
 	size_t unique_len;	  /**< Length of unique */
-	char   *unique;		  /**< Unique name for driver instantiation */
+	char   __user *unique;	  /**< Unique name for driver instantiation */
 } drm_unique_t;
 
 
 typedef struct drm_list {
 	int		 count;	  /**< Length of user-space structures */
-	drm_version_t	 *version;
+	drm_version_t	 __user *version;
 } drm_list_t;
 
 
@@ -380,7 +380,7 @@ typedef struct drm_buf_desc {
  */
 typedef struct drm_buf_info {
 	int	       count;	/**< Entries in list */
-	drm_buf_desc_t *list;
+	drm_buf_desc_t __user *list;
 } drm_buf_info_t;
 
 
@@ -389,7 +389,7 @@ typedef struct drm_buf_info {
  */
 typedef struct drm_buf_free {
 	int	       count;
-	int	       *list;
+	int	       __user *list;
 } drm_buf_free_t;
 
 
@@ -402,7 +402,7 @@ typedef struct drm_buf_pub {
 	int		  idx;	       /**< Index into the master buffer list */
 	int		  total;       /**< Buffer size */
 	int		  used;	       /**< Amount of buffer in use (for DMA) */
-	void		  *address;    /**< Address of buffer */
+	void	  __user *address;     /**< Address of buffer */
 } drm_buf_pub_t;
 
 
@@ -411,8 +411,8 @@ typedef struct drm_buf_pub {
  */
 typedef struct drm_buf_map {
 	int	      count;	/**< Length of the buffer list */
-	void	      *virtual;	/**< Mmap'd area in user-virtual */
-	drm_buf_pub_t *list;	/**< Buffer information */
+	void	      __user *virtual;	/**< Mmap'd area in user-virtual */
+	drm_buf_pub_t __user *list;	/**< Buffer information */
 } drm_buf_map_t;
 
 
@@ -426,13 +426,13 @@ typedef struct drm_buf_map {
 typedef struct drm_dma {
 	int		context;	  /**< Context handle */
 	int		send_count;	  /**< Number of buffers to send */
-	int		*send_indices;	  /**< List of handles to buffers */
-	int		*send_sizes;	  /**< Lengths of data to send */
+	int	__user *send_indices;	  /**< List of handles to buffers */
+	int	__user *send_sizes;	  /**< Lengths of data to send */
 	drm_dma_flags_t flags;		  /**< Flags */
 	int		request_count;	  /**< Number of buffers requested */
 	int		request_size;	  /**< Desired size for buffers */
-	int		*request_indices; /**< Buffer information */
-	int		*request_sizes;
+	int	__user *request_indices;  /**< Buffer information */
+	int	__user *request_sizes;
 	int		granted_count;	  /**< Number of buffers granted */
 } drm_dma_t;
 
@@ -459,7 +459,7 @@ typedef struct drm_ctx {
  */
 typedef struct drm_ctx_res {
 	int		count;
-	drm_ctx_t	*contexts;
+	drm_ctx_t	__user *contexts;
 } drm_ctx_res_t;
 
 

drivers/char/drm/drmP.h

@@ -599,7 +599,7 @@ typedef struct drm_ctx_list {
 	drm_file_t		*tag;   /**< associated fd private data */
 } drm_ctx_list_t;
 
-#if __HAVE_VBL_IRQ
+#ifdef __HAVE_VBL_IRQ
 
 typedef struct drm_vbl_sig {
 	struct list_head	head;
@@ -698,7 +698,7 @@ typedef struct drm_device {
 	struct work_struct	work;
 	/** \name VBLANK IRQ support */
 	/*@{*/
-#if __HAVE_VBL_IRQ
+#ifdef __HAVE_VBL_IRQ
    	wait_queue_head_t vbl_queue;	/**< VBLANK wait queue */
    	atomic_t          vbl_received;
 	spinlock_t        vbl_lock;
@@ -776,7 +776,7 @@ extern int	     DRM(mmap_dma)(struct file *filp,
 				   struct vm_area_struct *vma);
 extern int	     DRM(mmap)(struct file *filp, struct vm_area_struct *vma);
 extern unsigned int  DRM(poll)(struct file *filp, struct poll_table_struct *wait);
-extern ssize_t       DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off);
+extern ssize_t       DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off);
 
 				/* Memory management support (drm_memory.h) */
 extern void	     DRM(mem_init)(void);
@@ -915,13 +915,13 @@ extern irqreturn_t   DRM(irq_handler)( DRM_IRQ_ARGS );
 extern void          DRM(driver_irq_preinstall)( drm_device_t *dev );
 extern void          DRM(driver_irq_postinstall)( drm_device_t *dev );
 extern void          DRM(driver_irq_uninstall)( drm_device_t *dev );
-#if __HAVE_VBL_IRQ
+#ifdef __HAVE_VBL_IRQ
 extern int           DRM(wait_vblank)(struct inode *inode, struct file *filp,
 				      unsigned int cmd, unsigned long arg);
 extern int           DRM(vblank_wait)(drm_device_t *dev, unsigned int *vbl_seq);
 extern void          DRM(vbl_send_signals)( drm_device_t *dev );
 #endif
-#if __HAVE_IRQ_BH
+#ifdef __HAVE_IRQ_BH
 extern void          DRM(irq_immediate_bh)( void *dev );
 #endif
 #endif
@@ -969,7 +969,7 @@ extern int            DRM(proc_cleanup)(int minor,
 					struct proc_dir_entry *root,
 					struct proc_dir_entry *dev_root);
 
-#if __HAVE_SG
+#ifdef __HAVE_SG
 				/* Scatter Gather Support (drm_scatter.h) */
 extern void           DRM(sg_cleanup)(drm_sg_mem_t *entry);
 extern int            DRM(sg_alloc)(struct inode *inode, struct file *filp,

drivers/char/drm/drm_agpsupport.h

@@ -79,7 +79,7 @@ int DRM(agp_info)(struct inode *inode, struct file *filp,
 	info.id_vendor         = kern->device->vendor;
 	info.id_device         = kern->device->device;
 
-	if (copy_to_user((drm_agp_info_t *)arg, &info, sizeof(info)))
+	if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info)))
 		return -EFAULT;
 	return 0;
 }
@@ -173,7 +173,7 @@ int DRM(agp_enable)(struct inode *inode, struct file *filp,
 	if (!dev->agp || !dev->agp->acquired || !drm_agp->enable)
 		return -EINVAL;
 
-	if (copy_from_user(&mode, (drm_agp_mode_t *)arg, sizeof(mode)))
+	if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode)))
 		return -EFAULT;
 
 	dev->agp->mode    = mode.mode;
@@ -205,10 +205,11 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp,
 	DRM_AGP_MEM      *memory;
 	unsigned long    pages;
 	u32 		 type;
+	drm_agp_buffer_t __user *argp = (void __user *)arg;
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(alloc)(sizeof(*entry), DRM_MEM_AGPLISTS)))
 		return -ENOMEM;
@@ -236,7 +237,7 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp,
 	request.handle   = entry->handle;
 	request.physical = memory->physical;
 
-	if (copy_to_user((drm_agp_buffer_t *)arg, &request, sizeof(request))) {
+	if (copy_to_user(argp, &request, sizeof(request))) {
 		dev->agp->memory       = entry->next;
 		dev->agp->memory->prev = NULL;
 		DRM(free_agp)(memory, pages);
@@ -290,7 +291,7 @@ int DRM(agp_unbind)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
@@ -327,7 +328,7 @@ int DRM(agp_bind)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired || !drm_agp->bind_memory)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
@@ -366,7 +367,7 @@ int DRM(agp_free)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_buffer_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;

drivers/char/drm/drm_auth.h

@@ -194,7 +194,7 @@ int DRM(getmagic)(struct inode *inode, struct file *filp,
 	}
 
 	DRM_DEBUG("%u\n", auth.magic);
-	if (copy_to_user((drm_auth_t *)arg, &auth, sizeof(auth)))
+	if (copy_to_user((drm_auth_t __user *)arg, &auth, sizeof(auth)))
 		return -EFAULT;
 	return 0;
 }
@@ -218,7 +218,7 @@ int DRM(authmagic)(struct inode *inode, struct file *filp,
 	drm_auth_t	   auth;
 	drm_file_t	   *file;
 
-	if (copy_from_user(&auth, (drm_auth_t *)arg, sizeof(auth)))
+	if (copy_from_user(&auth, (drm_auth_t __user *)arg, sizeof(auth)))
 		return -EFAULT;
 	DRM_DEBUG("%u\n", auth.magic);
 	if ((file = DRM(find_file)(dev, auth.magic))) {

drivers/char/drm/drm_bufs.h

@@ -70,9 +70,10 @@ int DRM(order)( unsigned long size )
 	int order;
 	unsigned long tmp;
 
-	for ( order = 0, tmp = size ; tmp >>= 1 ; ++order );
+	for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++)
+		;
 
-	if ( size & ~(1 << order) )
+	if (size & (size - 1))
 		++order;
 
 	return order;
@@ -97,6 +98,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_map_t *map;
+	drm_map_t __user *argp = (void __user *)arg;
 	drm_map_list_t *list;
 
 	if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */
@@ -105,7 +107,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp,
 	if ( !map )
 		return -ENOMEM;
 
-	if ( copy_from_user( map, (drm_map_t *)arg, sizeof(*map) ) ) {
+	if ( copy_from_user( map, argp, sizeof(*map) ) ) {
 		DRM(free)( map, sizeof(*map), DRM_MEM_MAPS );
 		return -EFAULT;
 	}
@@ -206,10 +208,10 @@ int DRM(addmap)( struct inode *inode, struct file *filp,
 	list_add(&list->head, &dev->maplist->head);
  	up(&dev->struct_sem);
 
-	if ( copy_to_user( (drm_map_t *)arg, map, sizeof(*map) ) )
+	if ( copy_to_user( argp, map, sizeof(*map) ) )
 		return -EFAULT;
 	if ( map->type != _DRM_SHM ) {
-		if ( copy_to_user( &((drm_map_t *)arg)->handle,
+		if ( copy_to_user( &argp->handle,
 				   &map->offset,
 				   sizeof(map->offset) ) )
 			return -EFAULT;
@@ -246,7 +248,7 @@ int DRM(rmmap)(struct inode *inode, struct file *filp,
 	drm_map_t request;
 	int found_maps = 0;
 
-	if (copy_from_user(&request, (drm_map_t *)arg,
+	if (copy_from_user(&request, (drm_map_t __user *)arg,
 			   sizeof(request))) {
 		return -EFAULT;
 	}
@@ -388,10 +390,11 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp,
 	int byte_count;
 	int i;
 	drm_buf_t **temp_buflist;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 
 	if ( !dma ) return -EINVAL;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
+	if ( copy_from_user( &request, argp,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -528,7 +531,7 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp,
 	request.count = entry->buf_count;
 	request.size = size;
 
-	if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	dma->flags = _DRM_DMA_USE_AGP;
@@ -561,11 +564,11 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp,
 	int page_count;
 	unsigned long *temp_pagelist;
 	drm_buf_t **temp_buflist;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 
 	if ( !dma ) return -EINVAL;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	count = request.count;
@@ -766,7 +769,7 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp,
 	request.count = entry->buf_count;
 	request.size = size;
 
-	if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	atomic_dec( &dev->buf_alloc );
@@ -782,6 +785,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 	drm_buf_desc_t request;
 	drm_buf_entry_t *entry;
 	drm_buf_t *buf;
@@ -799,8 +803,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 
 	if ( !dma ) return -EINVAL;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
-                             sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	count = request.count;
@@ -876,7 +879,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 		buf->waiting = 0;
 		buf->pending = 0;
 		init_waitqueue_head( &buf->dma_wait );
-		buf->filp    = 0;
+		buf->filp    = NULL;
 
 		buf->dev_priv_size = sizeof(DRIVER_BUF_PRIV_T);
 		buf->dev_private = DRM(alloc)( sizeof(DRIVER_BUF_PRIV_T),
@@ -937,7 +940,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 	request.count = entry->buf_count;
 	request.size = size;
 
-	if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	dma->flags = _DRM_DMA_USE_SG;
@@ -966,7 +969,7 @@ int DRM(addbufs)( struct inode *inode, struct file *filp,
 {
 	drm_buf_desc_t request;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
+	if ( copy_from_user( &request, (drm_buf_desc_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -1012,6 +1015,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_device_dma_t *dma = dev->dma;
 	drm_buf_info_t request;
+	drm_buf_info_t __user *argp = (void __user *)arg;
 	int i;
 	int count;
 
@@ -1025,9 +1029,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	++dev->buf_use;		/* Can't allocate more after this call */
 	spin_unlock( &dev->count_lock );
 
-	if ( copy_from_user( &request,
-			     (drm_buf_info_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) {
@@ -1039,7 +1041,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	if ( request.count >= count ) {
 		for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) {
 			if ( dma->bufs[i].buf_count ) {
-				drm_buf_desc_t *to = &request.list[count];
+				drm_buf_desc_t __user *to = &request.list[count];
 				drm_buf_entry_t *from = &dma->bufs[i];
 				drm_freelist_t *list = &dma->bufs[i].freelist;
 				if ( copy_to_user( &to->count,
@@ -1068,9 +1070,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	}
 	request.count = count;
 
-	if ( copy_to_user( (drm_buf_info_t *)arg,
-			   &request,
-			   sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	return 0;
@@ -1103,7 +1103,7 @@ int DRM(markbufs)( struct inode *inode, struct file *filp,
 	if ( !dma ) return -EINVAL;
 
 	if ( copy_from_user( &request,
-			     (drm_buf_desc_t *)arg,
+			     (drm_buf_desc_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -1150,7 +1150,7 @@ int DRM(freebufs)( struct inode *inode, struct file *filp,
 	if ( !dma ) return -EINVAL;
 
 	if ( copy_from_user( &request,
-			     (drm_buf_free_t *)arg,
+			     (drm_buf_free_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -1196,6 +1196,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_map_t __user *argp = (void __user *)arg;
 	int retcode = 0;
 	const int zero = 0;
 	unsigned long virtual;
@@ -1213,8 +1214,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 	dev->buf_use++;		/* Can't allocate more after this call */
 	spin_unlock( &dev->count_lock );
 
-	if ( copy_from_user( &request, (drm_buf_map_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	if ( request.count >= dma->buf_count ) {
@@ -1261,7 +1261,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 			retcode = (signed long)virtual;
 			goto done;
 		}
-		request.virtual = (void *)virtual;
+		request.virtual = (void __user *)virtual;
 
 		for ( i = 0 ; i < dma->buf_count ; i++ ) {
 			if ( copy_to_user( &request.list[i].idx,
@@ -1295,7 +1295,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 	request.count = dma->buf_count;
 	DRM_DEBUG( "%d buffers, retcode = %d\n", request.count, retcode );
 
-	if ( copy_to_user( (drm_buf_map_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	return retcode;

drivers/char/drm/drm_context.h

@@ -214,12 +214,11 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
 
-	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
-			   sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 
 	down(&dev->struct_sem);
@@ -232,7 +231,7 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp,
 	up(&dev->struct_sem);
 
 	request.handle = map->handle;
-	if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request)))
+	if (copy_to_user(argp, &request, sizeof(request)))
 		return -EFAULT;
 	return 0;
 }
@@ -260,7 +259,7 @@ int DRM(setsareactx)(struct inode *inode, struct file *filp,
 	struct list_head *list;
 
 	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
+			   (drm_ctx_priv_map_t __user *)arg,
 			   sizeof(request)))
 		return -EFAULT;
 
@@ -363,10 +362,11 @@ int DRM(resctx)( struct inode *inode, struct file *filp,
 		 unsigned int cmd, unsigned long arg )
 {
 	drm_ctx_res_t res;
+	drm_ctx_t __user *argp = (void __user *)arg;
 	drm_ctx_t ctx;
 	int i;
 
-	if ( copy_from_user( &res, (drm_ctx_res_t *)arg, sizeof(res) ) )
+	if ( copy_from_user( &res, argp, sizeof(res) ) )
 		return -EFAULT;
 
 	if ( res.count >= DRM_RESERVED_CONTEXTS ) {
@@ -380,7 +380,7 @@ int DRM(resctx)( struct inode *inode, struct file *filp,
 	}
 	res.count = DRM_RESERVED_CONTEXTS;
 
-	if ( copy_to_user( (drm_ctx_res_t *)arg, &res, sizeof(res) ) )
+	if ( copy_to_user( argp, &res, sizeof(res) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -402,9 +402,10 @@ int DRM(addctx)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_ctx_list_t * ctx_entry;
+	drm_ctx_t __user *argp = (void __user *)arg;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, argp, sizeof(ctx) ) )
 		return -EFAULT;
 
 	ctx.handle = DRM(ctxbitmap_next)( dev );
@@ -437,7 +438,7 @@ int DRM(addctx)( struct inode *inode, struct file *filp,
 	++dev->ctx_count;
 	up( &dev->ctxlist_sem );
 
-	if ( copy_to_user( (drm_ctx_t *)arg, &ctx, sizeof(ctx) ) )
+	if ( copy_to_user( argp, &ctx, sizeof(ctx) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -461,15 +462,16 @@ int DRM(modctx)( struct inode *inode, struct file *filp,
 int DRM(getctx)( struct inode *inode, struct file *filp,
 		 unsigned int cmd, unsigned long arg )
 {
+	drm_ctx_t __user *argp = (void __user *)arg;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t*)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, argp, sizeof(ctx) ) )
 		return -EFAULT;
 
 	/* This is 0, because we don't handle any context flags */
 	ctx.flags = 0;
 
-	if ( copy_to_user( (drm_ctx_t*)arg, &ctx, sizeof(ctx) ) )
+	if ( copy_to_user( argp, &ctx, sizeof(ctx) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -492,7 +494,7 @@ int DRM(switchctx)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) )
 		return -EFAULT;
 
 	DRM_DEBUG( "%d\n", ctx.handle );
@@ -517,7 +519,7 @@ int DRM(newctx)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) )
 		return -EFAULT;
 
 	DRM_DEBUG( "%d\n", ctx.handle );
@@ -544,7 +546,7 @@ int DRM(rmctx)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) )
 		return -EFAULT;
 
 	DRM_DEBUG( "%d\n", ctx.handle );

drivers/char/drm/drm_dma.h

@@ -214,7 +214,7 @@ int DRM(control)( struct inode *inode, struct file *filp,
 {
 	drm_control_t ctl;
 
-	if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) )
+	if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) )
 		return -EFAULT;
 
 	switch ( ctl.func ) {

drivers/char/drm/drm_drawable.h

@@ -43,7 +43,7 @@ int DRM(adddraw)(struct inode *inode, struct file *filp,
 
 	draw.handle = 0;	/* NOOP */
 	DRM_DEBUG("%d\n", draw.handle);
-	if (copy_to_user((drm_draw_t *)arg, &draw, sizeof(draw)))
+	if (copy_to_user((drm_draw_t __user *)arg, &draw, sizeof(draw)))
 		return -EFAULT;
 	return 0;
 }

drivers/char/drm/drm_drv.h

@@ -243,7 +243,7 @@ static drm_ioctl_desc_t		  DRM(ioctls)[] = {
 	[DRM_IOCTL_NR(DRM_IOCTL_SG_FREE)]       = { DRM(sg_free),     1, 1 },
 #endif
 
-#if __HAVE_VBL_IRQ
+#ifdef __HAVE_VBL_IRQ
 	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK)]   = { DRM(wait_vblank), 0, 0 },
 #endif
 
@@ -741,12 +741,11 @@ module_exit( drm_cleanup );
 int DRM(version)( struct inode *inode, struct file *filp,
 		  unsigned int cmd, unsigned long arg )
 {
+	drm_version_t __user *argp = (void __user *)arg;
 	drm_version_t version;
 	int len;
 
-	if ( copy_from_user( &version,
-			     (drm_version_t *)arg,
-			     sizeof(version) ) )
+	if ( copy_from_user( &version, argp, sizeof(version) ) )
 		return -EFAULT;
 
 #define DRM_COPY( name, value )						\
@@ -766,9 +765,7 @@ int DRM(version)( struct inode *inode, struct file *filp,
 	DRM_COPY( version.date, DRIVER_DATE );
 	DRM_COPY( version.desc, DRIVER_DESC );
 
-	if ( copy_to_user( (drm_version_t *)arg,
-			   &version,
-			   sizeof(version) ) )
+	if ( copy_to_user( argp, &version, sizeof(version) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -1048,7 +1045,7 @@ int DRM(lock)( struct inode *inode, struct file *filp,
 
 	++priv->lock_count;
 
-        if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) )
+        if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) )
 		return -EFAULT;
 
         if ( lock.context == DRM_KERNEL_CONTEXT ) {
@@ -1161,7 +1158,7 @@ int DRM(unlock)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_lock_t lock;
 
-	if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) )
+	if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) )
 		return -EFAULT;
 
 	if ( lock.context == DRM_KERNEL_CONTEXT ) {

drivers/char/drm/drm_fops.h

@@ -141,7 +141,7 @@ unsigned int DRM(poll)(struct file *filp, struct poll_table_struct *wait)
 
 #if !__HAVE_DRIVER_FOPS_READ
 /** No-op. */
-ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off)
+ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off)
 {
 	return 0;
 }

drivers/char/drm/drm_ioctl.h

@@ -53,16 +53,17 @@ int DRM(getunique)(struct inode *inode, struct file *filp,
 {
 	drm_file_t	 *priv	 = filp->private_data;
 	drm_device_t	 *dev	 = priv->dev;
+	drm_unique_t	 __user *argp = (void __user *)arg;
 	drm_unique_t	 u;
 
-	if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u)))
+	if (copy_from_user(&u, argp, sizeof(u)))
 		return -EFAULT;
 	if (u.unique_len >= dev->unique_len) {
 		if (copy_to_user(u.unique, dev->unique, dev->unique_len))
 			return -EFAULT;
 	}
 	u.unique_len = dev->unique_len;
-	if (copy_to_user((drm_unique_t *)arg, &u, sizeof(u)))
+	if (copy_to_user(argp, &u, sizeof(u)))
 		return -EFAULT;
 	return 0;
 }
@@ -91,7 +92,8 @@ int DRM(setunique)(struct inode *inode, struct file *filp,
 
 	if (dev->unique_len || dev->unique) return -EBUSY;
 
-	if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u))) return -EFAULT;
+	if (copy_from_user(&u, (drm_unique_t __user *)arg, sizeof(u)))
+		return -EFAULT;
 
 	if (!u.unique_len || u.unique_len > 1024) return -EINVAL;
 
@@ -171,13 +173,14 @@ int DRM(getmap)( struct inode *inode, struct file *filp,
 {
 	drm_file_t   *priv = filp->private_data;
 	drm_device_t *dev  = priv->dev;
+	drm_map_t    __user *argp = (void __user *)arg;
 	drm_map_t    map;
 	drm_map_list_t *r_list = NULL;
 	struct list_head *list;
 	int          idx;
 	int	     i;
 
-	if (copy_from_user(&map, (drm_map_t *)arg, sizeof(map)))
+	if (copy_from_user(&map, argp, sizeof(map)))
 		return -EFAULT;
 	idx = map.offset;
 
@@ -208,7 +211,7 @@ int DRM(getmap)( struct inode *inode, struct file *filp,
 	map.mtrr   = r_list->map->mtrr;
 	up(&dev->struct_sem);
 
-	if (copy_to_user((drm_map_t *)arg, &map, sizeof(map))) return -EFAULT;
+	if (copy_to_user(argp, &map, sizeof(map))) return -EFAULT;
 	return 0;
 }
 
@@ -230,12 +233,13 @@ int DRM(getclient)( struct inode *inode, struct file *filp,
 {
 	drm_file_t   *priv = filp->private_data;
 	drm_device_t *dev  = priv->dev;
+	drm_client_t __user *argp = (void __user *)arg;
 	drm_client_t client;
 	drm_file_t   *pt;
 	int          idx;
 	int          i;
 
-	if (copy_from_user(&client, (drm_client_t *)arg, sizeof(client)))
+	if (copy_from_user(&client, argp, sizeof(client)))
 		return -EFAULT;
 	idx = client.idx;
 	down(&dev->struct_sem);
@@ -253,7 +257,7 @@ int DRM(getclient)( struct inode *inode, struct file *filp,
 	client.iocs  = pt->ioctl_count;
 	up(&dev->struct_sem);
 
-	if (copy_to_user((drm_client_t *)arg, &client, sizeof(client)))
+	if (copy_to_user((drm_client_t __user *)arg, &client, sizeof(client)))
 		return -EFAULT;
 	return 0;
 }
@@ -294,7 +298,7 @@ int DRM(getstats)( struct inode *inode, struct file *filp,
 
 	up(&dev->struct_sem);
 
-	if (copy_to_user((drm_stats_t *)arg, &stats, sizeof(stats)))
+	if (copy_to_user((drm_stats_t __user *)arg, &stats, sizeof(stats)))
 		return -EFAULT;
 	return 0;
 }
@@ -308,15 +312,16 @@ int DRM(setversion)(DRM_IOCTL_ARGS)
 	drm_set_version_t sv;
 	drm_set_version_t retv;
 	int if_version;
+	drm_set_version_t __user *argp = (void __user *)data;
 
-	DRM_COPY_FROM_USER_IOCTL(sv, (drm_set_version_t *)data, sizeof(sv));
+	DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));
 
 	retv.drm_di_major = DRM_IF_MAJOR;
 	retv.drm_di_minor = DRM_IF_MINOR;
 	retv.drm_dd_major = DRIVER_MAJOR;
 	retv.drm_dd_minor = DRIVER_MINOR;
 
-	DRM_COPY_TO_USER_IOCTL((drm_set_version_t *)data, retv, sizeof(sv));
+	DRM_COPY_TO_USER_IOCTL(argp, retv, sizeof(sv));
 
 	if (sv.drm_di_major != -1) {
 		if (sv.drm_di_major != DRM_IF_MAJOR ||

drivers/char/drm/drm_irq.h

@@ -65,9 +65,10 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp,
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
+	drm_irq_busid_t __user *argp = (void __user *)arg;
 	drm_irq_busid_t p;
 
-	if (copy_from_user(&p, (drm_irq_busid_t *)arg, sizeof(p)))
+	if (copy_from_user(&p, argp, sizeof(p)))
 		return -EFAULT;
 
 	if ((p.busnum >> 8) != dev->pci_domain ||
@@ -80,7 +81,7 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp,
 
 	DRM_DEBUG("%d:%d:%d => IRQ %d\n",
 		  p.busnum, p.devnum, p.funcnum, p.irq);
-	if (copy_to_user((drm_irq_busid_t *)arg, &p, sizeof(p)))
+	if (copy_to_user(argp, &p, sizeof(p)))
 		return -EFAULT;
 	return 0;
 }
@@ -127,11 +128,11 @@ int DRM(irq_install)( drm_device_t *dev )
 	dev->dma->this_buffer = NULL;
 #endif
 
-#if __HAVE_IRQ_BH
+#ifdef __HAVE_IRQ_BH
 	INIT_WORK(&dev->work, DRM(irq_immediate_bh), dev);
 #endif
 
-#if __HAVE_VBL_IRQ
+#ifdef __HAVE_VBL_IRQ
 	init_waitqueue_head(&dev->vbl_queue);
 
 	spin_lock_init( &dev->vbl_lock );
@@ -206,7 +207,7 @@ int DRM(control)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_control_t ctl;
 
-	if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) )
+	if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) )
 		return -EFAULT;
 
 	switch ( ctl.func ) {
@@ -222,7 +223,7 @@ int DRM(control)( struct inode *inode, struct file *filp,
 	}
 }
 
-#if __HAVE_VBL_IRQ
+#ifdef __HAVE_VBL_IRQ
 
 /**
  * Wait for VBLANK.
@@ -247,6 +248,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS )
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
+	drm_wait_vblank_t __user *argp = (void __user *)data;
 	drm_wait_vblank_t vblwait;
 	struct timeval now;
 	int ret = 0;
@@ -255,8 +257,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS )
 	if (!dev->irq)
 		return -EINVAL;
 
-	DRM_COPY_FROM_USER_IOCTL( vblwait, (drm_wait_vblank_t *)data,
-				  sizeof(vblwait) );
+	DRM_COPY_FROM_USER_IOCTL( vblwait, argp, sizeof(vblwait) );
 
 	switch ( vblwait.request.type & ~_DRM_VBLANK_FLAGS_MASK ) {
 	case _DRM_VBLANK_RELATIVE:
@@ -325,8 +326,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS )
 	}
 
 done:
-	DRM_COPY_TO_USER_IOCTL( (drm_wait_vblank_t *)data, vblwait,
-				sizeof(vblwait) );
+	DRM_COPY_TO_USER_IOCTL( argp, vblwait, sizeof(vblwait) );
 
 	return ret;
 }

drivers/char/drm/drm_scatter.h

@@ -66,6 +66,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp,
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
+	drm_scatter_gather_t __user *argp = (void __user *)arg;
 	drm_scatter_gather_t request;
 	drm_sg_mem_t *entry;
 	unsigned long pages, i, j;
@@ -75,9 +76,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp,
 	if ( dev->sg )
 		return -EINVAL;
 
-	if ( copy_from_user( &request,
-			     (drm_scatter_gather_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	entry = DRM(alloc)( sizeof(*entry), DRM_MEM_SGLISTS );
@@ -145,9 +144,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp,
 
 	request.handle = entry->handle;
 
-	if ( copy_to_user( (drm_scatter_gather_t *)arg,
-			   &request,
-			   sizeof(request) ) ) {
+	if ( copy_to_user( argp, &request, sizeof(request) ) ) {
 		DRM(sg_cleanup)( entry );
 		return -EFAULT;
 	}
@@ -210,7 +207,7 @@ int DRM(sg_free)( struct inode *inode, struct file *filp,
 	drm_sg_mem_t *entry;
 
 	if ( copy_from_user( &request,
-			     (drm_scatter_gather_t *)arg,
+			     (drm_scatter_gather_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 

drivers/char/drm/drm_vm.h

@@ -75,7 +75,7 @@ static __inline__ struct page *DRM(do_vm_nopage)(struct vm_area_struct *vma,
 		struct drm_agp_mem *agpmem;
 		struct page *page;
 
-#if __alpha__
+#ifdef __alpha__
 		/*
                  * Adjust to a bus-relative address
                  */

drivers/char/drm/gamma_context.h

@@ -42,7 +42,7 @@
    the circular buffer), is based on Alessandro Rubini's LINUX DEVICE
    DRIVERS (Cambridge: O'Reilly, 1998), pages 111-113. */
 
-ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off)
+ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off)
 {
 	drm_file_t    *priv   = filp->private_data;
 	drm_device_t  *dev    = priv->dev;
@@ -295,12 +295,13 @@ static int DRM(alloc_queue)(drm_device_t *dev)
 int DRM(resctx)(struct inode *inode, struct file *filp,
 		unsigned int cmd, unsigned long arg)
 {
+	drm_ctx_res_t __user *argp = (void __user *)arg;
 	drm_ctx_res_t	res;
 	drm_ctx_t	ctx;
 	int		i;
 
 	DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS);
-	if (copy_from_user(&res, (drm_ctx_res_t *)arg, sizeof(res)))
+	if (copy_from_user(&res, argp, sizeof(res)))
 		return -EFAULT;
 	if (res.count >= DRM_RESERVED_CONTEXTS) {
 		memset(&ctx, 0, sizeof(ctx));
@@ -313,7 +314,7 @@ int DRM(resctx)(struct inode *inode, struct file *filp,
 		}
 	}
 	res.count = DRM_RESERVED_CONTEXTS;
-	if (copy_to_user((drm_ctx_res_t *)arg, &res, sizeof(res)))
+	if (copy_to_user(argp, &res, sizeof(res)))
 		return -EFAULT;
 	return 0;
 }
@@ -324,8 +325,9 @@ int DRM(addctx)(struct inode *inode, struct file *filp,
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
+	drm_ctx_t	__user *argp = (void __user *)arg;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, argp, sizeof(ctx)))
 		return -EFAULT;
 	if ((ctx.handle = DRM(alloc_queue)(dev)) == DRM_KERNEL_CONTEXT) {
 				/* Init kernel's context and get a new one. */
@@ -334,7 +336,7 @@ int DRM(addctx)(struct inode *inode, struct file *filp,
 	}
 	DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx);
 	DRM_DEBUG("%d\n", ctx.handle);
-	if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx)))
+	if (copy_to_user(argp, &ctx, sizeof(ctx)))
 		return -EFAULT;
 	return 0;
 }
@@ -347,7 +349,7 @@ int DRM(modctx)(struct inode *inode, struct file *filp,
 	drm_ctx_t	ctx;
 	drm_queue_t	*q;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 
 	DRM_DEBUG("%d\n", ctx.handle);
@@ -378,10 +380,11 @@ int DRM(getctx)(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	__user *argp = (void __user *)arg;
 	drm_ctx_t	ctx;
 	drm_queue_t	*q;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, argp, sizeof(ctx)))
 		return -EFAULT;
 
 	DRM_DEBUG("%d\n", ctx.handle);
@@ -399,7 +402,7 @@ int DRM(getctx)(struct inode *inode, struct file *filp,
 	ctx.flags = q->flags;
 	atomic_dec(&q->use_count);
 
-	if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx)))
+	if (copy_to_user(argp, &ctx, sizeof(ctx)))
 		return -EFAULT;
 
 	return 0;
@@ -412,7 +415,7 @@ int DRM(switchctx)(struct inode *inode, struct file *filp,
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 	return DRM(context_switch)(dev, dev->last_context, ctx.handle);
@@ -425,7 +428,7 @@ int DRM(newctx)(struct inode *inode, struct file *filp,
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 	DRM(context_switch_complete)(dev, ctx.handle);
@@ -442,7 +445,7 @@ int DRM(rmctx)(struct inode *inode, struct file *filp,
 	drm_queue_t	*q;
 	drm_buf_t	*buf;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 

drivers/char/drm/gamma_dma.c

@@ -565,9 +565,10 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
 	drm_device_t	  *dev	    = priv->dev;
 	drm_device_dma_t  *dma	    = dev->dma;
 	int		  retcode   = 0;
+	drm_dma_t	  __user *argp = (void __user *)arg;
 	drm_dma_t	  d;
 
-	if (copy_from_user(&d, (drm_dma_t *)arg, sizeof(d)))
+	if (copy_from_user(&d, argp, sizeof(d)))
 		return -EFAULT;
 
 	if (d.send_count < 0 || d.send_count > dma->buf_count) {
@@ -597,7 +598,7 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	DRM_DEBUG("%d returning, granted = %d\n",
 		  current->pid, d.granted_count);
-	if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d)))
+	if (copy_to_user(argp, &d, sizeof(d)))
 		return -EFAULT;
 
 	return retcode;
@@ -720,7 +721,7 @@ int gamma_dma_init( struct inode *inode, struct file *filp,
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	if ( copy_from_user( &init, (drm_gamma_init_t *)arg, sizeof(init) ) )
+	if ( copy_from_user( &init, (drm_gamma_init_t __user *)arg, sizeof(init) ) )
 		return -EFAULT;
 
 	switch ( init.func ) {
@@ -789,7 +790,7 @@ int gamma_dma_copy( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_gamma_copy_t copy;
 
-	if ( copy_from_user( &copy, (drm_gamma_copy_t *)arg, sizeof(copy) ) )
+	if ( copy_from_user( &copy, (drm_gamma_copy_t __user *)arg, sizeof(copy) ) )
 		return -EFAULT;
 
 	return gamma_do_copy_dma( dev, &copy );
@@ -804,12 +805,11 @@ int gamma_getsareactx(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
 
-	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
-			   sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 
 	down(&dev->struct_sem);
@@ -822,7 +822,7 @@ int gamma_getsareactx(struct inode *inode, struct file *filp,
 	up(&dev->struct_sem);
 
 	request.handle = map->handle;
-	if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request)))
+	if (copy_to_user(argp, &request, sizeof(request)))
 		return -EFAULT;
 	return 0;
 }
@@ -838,7 +838,7 @@ int gamma_setsareactx(struct inode *inode, struct file *filp,
 	struct list_head *list;
 
 	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
+			   (drm_ctx_priv_map_t __user *)arg,
 			   sizeof(request)))
 		return -EFAULT;
 

drivers/char/drm/gamma_lock.h

@@ -132,7 +132,7 @@ int DRM(finish)(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	DRM_DEBUG("\n");
 
-	if (copy_from_user(&lock, (drm_lock_t *)arg, sizeof(lock)))
+	if (copy_from_user(&lock, (drm_lock_t __user *)arg, sizeof(lock)))
 		return -EFAULT;
 	ret = DRM(flush_block_and_flush)(dev, lock.context, lock.flags);
 	DRM(flush_unblock)(dev, lock.context, lock.flags);

drivers/char/drm/i810_dma.c

@@ -171,7 +171,7 @@ static int i810_map_buffer(drm_buf_t *buf, struct file *filp)
 		/* Real error */
 		DRM_ERROR("mmap error\n");
 		retcode = (signed int)buf_priv->virtual;
-		buf_priv->virtual = 0;
+		buf_priv->virtual = NULL;
 	}
 	up_write( &current->mm->mmap_sem );
 
@@ -193,7 +193,7 @@ static int i810_unmap_buffer(drm_buf_t *buf)
 	up_write(&current->mm->mmap_sem);
 
    	buf_priv->currently_mapped = I810_BUF_UNMAPPED;
-   	buf_priv->virtual = 0;
+   	buf_priv->virtual = NULL;
 
 	return retcode;
 }
@@ -459,7 +459,7 @@ int i810_dma_init_compat(drm_i810_init_t *init, unsigned long arg)
 {
 
 	/* Get v1.1 init data */
-	if (copy_from_user(init, (drm_i810_pre12_init_t *)arg,
+	if (copy_from_user(init, (drm_i810_pre12_init_t __user *)arg,
 			  sizeof(drm_i810_pre12_init_t))) {
 		return -EFAULT;
 	}
@@ -468,7 +468,7 @@ int i810_dma_init_compat(drm_i810_init_t *init, unsigned long arg)
 
 		/* This is a v1.2 client, just get the v1.2 init data */
 		DRM_INFO("Using POST v1.2 init.\n");
-		if (copy_from_user(init, (drm_i810_init_t *)arg,
+		if (copy_from_user(init, (drm_i810_init_t __user *)arg,
 				   sizeof(drm_i810_init_t))) {
 			return -EFAULT;
 		}
@@ -497,7 +497,7 @@ int i810_dma_init(struct inode *inode, struct file *filp,
    	int retcode = 0;
 
 	/* Get only the init func */
-	if (copy_from_user(&init, (void *)arg, sizeof(drm_i810_init_func_t))) 
+	if (copy_from_user(&init, (void __user *)arg, sizeof(drm_i810_init_func_t))) 
 		return -EFAULT;
 
    	switch(init.func) {
@@ -521,7 +521,7 @@ int i810_dma_init(struct inode *inode, struct file *filp,
 		default:
 	 	case I810_INIT_DMA_1_4:
 			DRM_INFO("Using v1.4 init.\n");
-  			if (copy_from_user(&init, (drm_i810_init_t *)arg,
+  			if (copy_from_user(&init, (drm_i810_init_t __user *)arg,
 					  sizeof(drm_i810_init_t))) {
 				return -EFAULT;
 			}
@@ -846,11 +846,11 @@ static void i810_dma_dispatch_vertex(drm_device_t *dev,
 
 		put_user((GFX_OP_PRIMITIVE | prim |
 					     ((used/4)-2)),
-		(u32 *)buf_priv->virtual);
+		(u32 __user *)buf_priv->virtual);
 
 		if (used & 4) {
 			put_user(0,
-			(u32 *)((u32)buf_priv->virtual + used));
+			(u32 __user *)((u32)buf_priv->virtual + used));
 			used += 4;
 		}
 
@@ -1056,7 +1056,7 @@ int i810_dma_vertex(struct inode *inode, struct file *filp,
      					dev_priv->sarea_priv;
 	drm_i810_vertex_t vertex;
 
-	if (copy_from_user(&vertex, (drm_i810_vertex_t *)arg, sizeof(vertex)))
+	if (copy_from_user(&vertex, (drm_i810_vertex_t __user *)arg, sizeof(vertex)))
 		return -EFAULT;
 
 	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1091,7 +1091,7 @@ int i810_clear_bufs(struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_i810_clear_t clear;
 
-   	if (copy_from_user(&clear, (drm_i810_clear_t *)arg, sizeof(clear)))
+   	if (copy_from_user(&clear, (drm_i810_clear_t __user *)arg, sizeof(clear)))
 		return -EFAULT;
 
 	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1153,7 +1153,7 @@ int i810_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
    	drm_i810_sarea_t *sarea_priv = (drm_i810_sarea_t *)
      					dev_priv->sarea_priv;
 
-   	if (copy_from_user(&d, (drm_i810_dma_t *)arg, sizeof(d)))
+   	if (copy_from_user(&d, (drm_i810_dma_t __user *)arg, sizeof(d)))
 		return -EFAULT;
 
 	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1168,7 +1168,7 @@ int i810_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
 	DRM_DEBUG("i810_dma: %d returning %d, granted = %d\n",
 		  current->pid, retcode, d.granted);
 
-	if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d)))
+	if (copy_to_user((drm_dma_t __user *)arg, &d, sizeof(d)))
 		return -EFAULT;
    	sarea_priv->last_dispatch = (int) hw_status[5];
 
@@ -1266,7 +1266,7 @@ int i810_dma_mc(struct inode *inode, struct file *filp,
 		dev_priv->sarea_priv;
 	drm_i810_mc_t mc;
 
-	if (copy_from_user(&mc, (drm_i810_mc_t *)arg, sizeof(mc)))
+	if (copy_from_user(&mc, (drm_i810_mc_t __user *)arg, sizeof(mc)))
 		return -EFAULT;
 
 
@@ -1309,7 +1309,7 @@ int i810_ov0_info(struct inode *inode, struct file *filp,
 
 	data.offset = dev_priv->overlay_offset;
 	data.physical = dev_priv->overlay_physical;
-	if (copy_to_user((drm_i810_overlay_t *)arg,&data,sizeof(data)))
+	if (copy_to_user((drm_i810_overlay_t __user *)arg,&data,sizeof(data)))
 		return -EFAULT;
 	return 0;
 }

drivers/char/drm/i830_dma.c

@@ -153,6 +153,7 @@ static int i830_map_buffer(drm_buf_t *buf, struct file *filp)
 	drm_i830_buf_priv_t *buf_priv = buf->dev_private;
       	drm_i830_private_t *dev_priv = dev->dev_private;
    	struct file_operations *old_fops;
+	unsigned long virtual;
 	int retcode = 0;
 
 	if(buf_priv->currently_mapped == I830_BUF_MAPPED) return -EINVAL;
@@ -161,17 +162,17 @@ static int i830_map_buffer(drm_buf_t *buf, struct file *filp)
 	old_fops = filp->f_op;
 	filp->f_op = &i830_buffer_fops;
 	dev_priv->mmap_buffer = buf;
-	buf_priv->virtual = (void __user *)do_mmap(filp, 0, buf->total,
-					    PROT_READ|PROT_WRITE,
-					    MAP_SHARED, 
-					    buf->bus_address);
+	virtual = do_mmap(filp, 0, buf->total, PROT_READ|PROT_WRITE,
+			    MAP_SHARED, buf->bus_address);
 	dev_priv->mmap_buffer = NULL;
 	filp->f_op = old_fops;
-	if (IS_ERR(buf_priv->virtual)) {
+	if (IS_ERR((void *)virtual)) {		/* ugh */
 		/* Real error */
 		DRM_ERROR("mmap error\n");
-		retcode = PTR_ERR(buf_priv->virtual);
+		retcode = virtual;
 		buf_priv->virtual = NULL;
+	} else {
+		buf_priv->virtual = (void __user *)virtual;
 	}
 	up_write( &current->mm->mmap_sem );
 
@@ -463,7 +464,7 @@ static int i830_dma_initialize(drm_device_t *dev,
 }
 
 int i830_dma_init(struct inode *inode, struct file *filp,
-		  unsigned int cmd, unsigned long __user arg)
+		  unsigned int cmd, unsigned long arg)
 {
    	drm_file_t *priv = filp->private_data;
    	drm_device_t *dev = priv->dev;
@@ -1165,7 +1166,7 @@ static void i830_dma_dispatch_vertex(drm_device_t *dev,
    	DRM_DEBUG(  "start + used - 4 : %ld\n", start + used - 4);
 
 	if (buf_priv->currently_mapped == I830_BUF_MAPPED) {
-		u32  *vp = buf_priv->virtual;
+		u32  __user *vp = buf_priv->virtual;
 
 		put_user( (GFX_OP_PRIMITIVE |
 			 sarea_priv->vertex_prim |
@@ -1315,7 +1316,7 @@ void i830_reclaim_buffers( struct file *filp )
 }
 
 int i830_flush_ioctl(struct inode *inode, struct file *filp, 
-		     unsigned int cmd, unsigned long __user arg)
+		     unsigned int cmd, unsigned long arg)
 {
    	drm_file_t	  *priv	  = filp->private_data;
    	drm_device_t	  *dev	  = priv->dev;
@@ -1330,7 +1331,7 @@ int i830_flush_ioctl(struct inode *inode, struct file *filp,
 }
 
 int i830_dma_vertex(struct inode *inode, struct file *filp,
-	       unsigned int cmd, unsigned long __user arg)
+	       unsigned int cmd, unsigned long arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1365,7 +1366,7 @@ int i830_dma_vertex(struct inode *inode, struct file *filp,
 }
 
 int i830_clear_bufs(struct inode *inode, struct file *filp,
-		   unsigned int cmd, unsigned long __user arg)
+		   unsigned int cmd, unsigned long arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1392,7 +1393,7 @@ int i830_clear_bufs(struct inode *inode, struct file *filp,
 }
 
 int i830_swap_bufs(struct inode *inode, struct file *filp,
-		  unsigned int cmd, unsigned long __user arg)
+		  unsigned int cmd, unsigned long arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1435,7 +1436,7 @@ int i830_do_cleanup_pageflip( drm_device_t *dev )
 }
 
 int i830_flip_bufs(struct inode *inode, struct file *filp,
-		   unsigned int cmd, unsigned long __user arg)
+		   unsigned int cmd, unsigned long arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1456,7 +1457,7 @@ int i830_flip_bufs(struct inode *inode, struct file *filp,
 }
 
 int i830_getage(struct inode *inode, struct file *filp, unsigned int cmd,
-		unsigned long __user arg)
+		unsigned long arg)
 {
    	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1470,7 +1471,7 @@ int i830_getage(struct inode *inode, struct file *filp, unsigned int cmd,
 }
 
 int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
-		unsigned long __user arg)
+		unsigned long arg)
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1507,7 +1508,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
 int i830_copybuf(struct inode *inode,
 		 struct file *filp, 
 		 unsigned int cmd,
-		 unsigned long __user arg)
+		 unsigned long arg)
 {
 	/* Never copy - 2.4.x doesn't need it */
 	return 0;
@@ -1522,7 +1523,7 @@ int i830_docopy(struct inode *inode, struct file *filp, unsigned int cmd,
 
 
 int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
-		      unsigned long __user arg )
+		      unsigned long arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1556,7 +1557,7 @@ int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
 
 
 int i830_setparam( struct inode *inode, struct file *filp, unsigned int cmd,
-		   unsigned long __user arg )
+		   unsigned long arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;

drivers/char/drm/i830_irq.c

@@ -121,7 +121,7 @@ int i830_wait_irq(drm_device_t *dev, int irq_nr)
 /* Needs the lock as it touches the ring.
  */
 int i830_irq_emit( struct inode *inode, struct file *filp, unsigned int cmd,
-		   unsigned long __user arg )
+		   unsigned long arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -139,7 +139,7 @@ int i830_irq_emit( struct inode *inode, struct file *filp, unsigned int cmd,
 		return -EINVAL;
 	}
 
-	if (copy_from_user( &emit, (drm_i830_irq_emit_t *)arg, sizeof(emit) ))
+	if (copy_from_user( &emit, (drm_i830_irq_emit_t __user *)arg, sizeof(emit) ))
 		return -EFAULT;
 
 	result = i830_emit_irq( dev );
@@ -168,7 +168,7 @@ int i830_irq_wait( struct inode *inode, struct file *filp, unsigned int cmd,
 		return -EINVAL;
 	}
 
-	if (copy_from_user( &irqwait, (drm_i830_irq_wait_t *)arg, 
+	if (copy_from_user( &irqwait, (drm_i830_irq_wait_t __user *)arg, 
 			    sizeof(irqwait) ))
 		return -EFAULT;
 

drivers/char/drm/mga_dma.c

@@ -668,7 +668,7 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t *)data, sizeof(init) );
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case MGA_INIT_DMA:
@@ -693,7 +693,7 @@ int mga_dma_flush( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( lock, (drm_lock_t *)data, sizeof(lock) );
+	DRM_COPY_FROM_USER_IOCTL( lock, (drm_lock_t __user *)data, sizeof(lock) );
 
 	DRM_DEBUG( "%s%s%s\n",
 		   (lock.flags & _DRM_LOCK_FLUSH) ?	"flush, " : "",
@@ -764,12 +764,13 @@ int mga_dma_buffers( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_device_dma_t *dma = dev->dma;
 	drm_mga_private_t *dev_priv = (drm_mga_private_t *)dev->dev_private;
+	drm_dma_t __user *argp = (void __user *)data;
 	drm_dma_t d;
 	int ret = 0;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *)data, sizeof(d) );
+	DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) );
 
 	/* Please don't send us buffers.
 	 */
@@ -795,7 +796,7 @@ int mga_dma_buffers( DRM_IOCTL_ARGS )
 		ret = mga_dma_get_buffers( filp, dev, &d );
 	}
 
-	DRM_COPY_TO_USER_IOCTL( (drm_dma_t *)data, d, sizeof(d) );
+	DRM_COPY_TO_USER_IOCTL( argp, d, sizeof(d) );
 
 	return ret;
 }

drivers/char/drm/mga_drm.h

@@ -343,7 +343,7 @@ typedef struct _drm_mga_blit {
 
 typedef struct drm_mga_getparam {
 	int param;
-	void *value;
+	void __user *value;
 } drm_mga_getparam_t;
 
 #endif

drivers/char/drm/mga_state.c

@@ -889,7 +889,7 @@ int mga_dma_clear( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( clear, (drm_mga_clear_t *)data, sizeof(clear) );
+	DRM_COPY_FROM_USER_IOCTL( clear, (drm_mga_clear_t __user *)data, sizeof(clear) );
 
 	if ( sarea_priv->nbox > MGA_NR_SAREA_CLIPRECTS )
 		sarea_priv->nbox = MGA_NR_SAREA_CLIPRECTS;
@@ -939,7 +939,7 @@ int mga_dma_vertex( DRM_IOCTL_ARGS )
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
 	DRM_COPY_FROM_USER_IOCTL( vertex,
-			     (drm_mga_vertex_t *)data,
+			     (drm_mga_vertex_t __user *)data,
 			     sizeof(vertex) );
 
         if(vertex.idx < 0 || vertex.idx > dma->buf_count) return DRM_ERR(EINVAL);
@@ -978,7 +978,7 @@ int mga_dma_indices( DRM_IOCTL_ARGS )
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
 	DRM_COPY_FROM_USER_IOCTL( indices,
-			     (drm_mga_indices_t *)data,
+			     (drm_mga_indices_t __user *)data,
 			     sizeof(indices) );
 
         if(indices.idx < 0 || indices.idx > dma->buf_count) return DRM_ERR(EINVAL);
@@ -1017,7 +1017,7 @@ int mga_dma_iload( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( iload, (drm_mga_iload_t *)data, sizeof(iload) );
+	DRM_COPY_FROM_USER_IOCTL( iload, (drm_mga_iload_t __user *)data, sizeof(iload) );
 
 #if 0
 	if ( mga_do_wait_for_idle( dev_priv ) < 0 ) {
@@ -1057,7 +1057,7 @@ int mga_dma_blit( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( blit, (drm_mga_blit_t *)data, sizeof(blit) );
+	DRM_COPY_FROM_USER_IOCTL( blit, (drm_mga_blit_t __user *)data, sizeof(blit) );
 
 	if ( sarea_priv->nbox > MGA_NR_SAREA_CLIPRECTS )
 		sarea_priv->nbox = MGA_NR_SAREA_CLIPRECTS;
@@ -1088,7 +1088,7 @@ int mga_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_mga_getparam_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_mga_getparam_t __user *)data,
 			     sizeof(param) );
 
 	DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID );

drivers/char/drm/r128_cce.c

@@ -632,7 +632,7 @@ int r128_cce_init( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t *)data, sizeof(init) );
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case R128_INIT_CCE:
@@ -675,7 +675,7 @@ int r128_cce_stop( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL(stop, (drm_r128_cce_stop_t *)data, sizeof(stop) );
+	DRM_COPY_FROM_USER_IOCTL(stop, (drm_r128_cce_stop_t __user *)data, sizeof(stop) );
 
 	/* Flush any pending CCE commands.  This ensures any outstanding
 	 * commands are exectuted by the engine before we turn it off.
@@ -912,11 +912,12 @@ int r128_cce_buffers( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_device_dma_t *dma = dev->dma;
 	int ret = 0;
+	drm_dma_t __user *argp = (void __user *)data;
 	drm_dma_t d;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *) data, sizeof(d) );
+	DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) );
 
 	/* Please don't send us buffers.
 	 */
@@ -940,7 +941,7 @@ int r128_cce_buffers( DRM_IOCTL_ARGS )
 		ret = r128_cce_get_buffers( filp, dev, &d );
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_dma_t *) data, d, sizeof(d) );
+	DRM_COPY_TO_USER_IOCTL(argp, d, sizeof(d) );
 
 	return ret;
 }

drivers/char/drm/r128_drm.h

@@ -308,14 +308,14 @@ typedef struct drm_r128_depth {
 		R128_READ_PIXELS	= 0x04
 	} func;
 	int n;
-	int *x;
-	int *y;
-	unsigned int *buffer;
-	unsigned char *mask;
+	int __user *x;
+	int __user *y;
+	unsigned int __user *buffer;
+	unsigned char __user *mask;
 } drm_r128_depth_t;
 
 typedef struct drm_r128_stipple {
-	unsigned int *mask;
+	unsigned int __user *mask;
 } drm_r128_stipple_t;
 
 typedef struct drm_r128_indirect {
@@ -339,7 +339,7 @@ typedef struct drm_r128_fullscreen {
 
 typedef struct drm_r128_getparam {
 	int param;
-	void *value;
+	void __user *value;
 } drm_r128_getparam_t;
 
 #endif

drivers/char/drm/r128_state.c

@@ -1271,7 +1271,7 @@ int r128_cce_clear( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( clear, (drm_r128_clear_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( clear, (drm_r128_clear_t __user *) data,
 			     sizeof(clear) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -1386,7 +1386,7 @@ int r128_cce_vertex( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_r128_vertex_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_r128_vertex_t __user *) data,
 			     sizeof(vertex) );
 
 	DRM_DEBUG( "pid=%d index=%d count=%d discard=%d\n",
@@ -1447,7 +1447,7 @@ int r128_cce_indices( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( elts, (drm_r128_indices_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( elts, (drm_r128_indices_t __user *) data,
 			     sizeof(elts) );
 
 	DRM_DEBUG( "pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID,
@@ -1512,7 +1512,7 @@ int r128_cce_blit( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( blit, (drm_r128_blit_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( blit, (drm_r128_blit_t __user *) data,
 			     sizeof(blit) );
 
 	DRM_DEBUG( "pid=%d index=%d\n", DRM_CURRENTPID, blit.idx );
@@ -1541,7 +1541,7 @@ int r128_cce_depth( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( depth, (drm_r128_depth_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( depth, (drm_r128_depth_t __user *) data,
 			     sizeof(depth) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -1571,7 +1571,7 @@ int r128_cce_stipple( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_r128_stipple_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_r128_stipple_t __user *) data,
 			     sizeof(stipple) );
 
 	if ( DRM_COPY_FROM_USER( &mask, stipple.mask,
@@ -1605,7 +1605,7 @@ int r128_cce_indirect( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_r128_indirect_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_r128_indirect_t __user *) data,
 			     sizeof(indirect) );
 
 	DRM_DEBUG( "indirect: idx=%d s=%d e=%d d=%d\n",
@@ -1674,7 +1674,7 @@ int r128_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_r128_getparam_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_r128_getparam_t __user *)data,
 			     sizeof(param) );
 
 	DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID );

drivers/char/drm/radeon_cp.c

@@ -1358,7 +1358,7 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t *)data, sizeof(init) );
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case RADEON_INIT_CP:
@@ -1407,7 +1407,7 @@ int radeon_cp_stop( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( stop, (drm_radeon_cp_stop_t *)data, sizeof(stop) );
+	DRM_COPY_FROM_USER_IOCTL( stop, (drm_radeon_cp_stop_t __user *)data, sizeof(stop) );
 
 	if (!dev_priv->cp_running)
 		return 0;
@@ -1712,11 +1712,12 @@ int radeon_cp_buffers( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_device_dma_t *dma = dev->dma;
 	int ret = 0;
+	drm_dma_t __user *argp = (void __user *)data;
 	drm_dma_t d;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *)data, sizeof(d) );
+	DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) );
 
 	/* Please don't send us buffers.
 	 */
@@ -1740,7 +1741,7 @@ int radeon_cp_buffers( DRM_IOCTL_ARGS )
 		ret = radeon_cp_get_buffers( filp, dev, &d );
 	}
 
-	DRM_COPY_TO_USER_IOCTL( (drm_dma_t *)data, d, sizeof(d) );
+	DRM_COPY_TO_USER_IOCTL( argp, d, sizeof(d) );
 
 	return ret;
 }

drivers/char/drm/radeon_drm.h

@@ -482,7 +482,7 @@ typedef struct drm_radeon_clear {
 	unsigned int clear_depth;
 	unsigned int color_mask;
 	unsigned int depth_mask;   /* misnamed field:  should be stencil */
-	drm_radeon_clear_rect_t *depth_boxes;
+	drm_radeon_clear_rect_t __user *depth_boxes;
 } drm_radeon_clear_t;
 
 typedef struct drm_radeon_vertex {
@@ -508,9 +508,9 @@ typedef struct drm_radeon_vertex2 {
 	int idx;			/* Index of vertex buffer */
 	int discard;			/* Client finished with buffer? */
 	int nr_states;
-	drm_radeon_state_t *state;
+	drm_radeon_state_t __user *state;
 	int nr_prims;
-	drm_radeon_prim_t *prim;
+	drm_radeon_prim_t __user *prim;
 } drm_radeon_vertex2_t;
 
 /* v1.3 - obsoletes drm_radeon_vertex2
@@ -525,15 +525,15 @@ typedef struct drm_radeon_vertex2 {
  */
 typedef struct drm_radeon_cmd_buffer {
 	int bufsz;
-	char *buf;
+	char __user *buf;
 	int nbox;
-	drm_clip_rect_t *boxes;
+	drm_clip_rect_t __user *boxes;
 } drm_radeon_cmd_buffer_t;
 
 typedef struct drm_radeon_tex_image {
 	unsigned int x, y;		/* Blit coordinates */
 	unsigned int width, height;
-	const void *data;
+	const void __user *data;
 } drm_radeon_tex_image_t;
 
 typedef struct drm_radeon_texture {
@@ -542,11 +542,11 @@ typedef struct drm_radeon_texture {
 	int format;
 	int width;			/* Texture image coordinates */
 	int height;
-	drm_radeon_tex_image_t *image;
+	drm_radeon_tex_image_t __user *image;
 } drm_radeon_texture_t;
 
 typedef struct drm_radeon_stipple {
-	unsigned int *mask;
+	unsigned int __user *mask;
 } drm_radeon_stipple_t;
 
 typedef struct drm_radeon_indirect {
@@ -576,7 +576,7 @@ typedef struct drm_radeon_indirect {
 
 typedef struct drm_radeon_getparam {
 	int param;
-	void *value;
+	void __user *value;
 } drm_radeon_getparam_t;
 
 /* 1.6: Set up a memory manager for regions of shared memory:
@@ -588,7 +588,7 @@ typedef struct drm_radeon_mem_alloc {
 	int region;
 	int alignment;
 	int size;
-	int *region_offset;	/* offset from start of fb or GART */
+	int __user *region_offset;	/* offset from start of fb or GART */
 } drm_radeon_mem_alloc_t;
 
 typedef struct drm_radeon_mem_free {
@@ -606,7 +606,7 @@ typedef struct drm_radeon_mem_init_heap {
 /* 1.6: Userspace can request & wait on irq's:
  */
 typedef struct drm_radeon_irq_emit {
-	int *irq_seq;
+	int __user *irq_seq;
 } drm_radeon_irq_emit_t;
 
 typedef struct drm_radeon_irq_wait {

drivers/char/drm/radeon_drv.h

@@ -887,7 +887,7 @@ do {									\
 
 #define OUT_RING_USER_TABLE( tab, sz ) do {			\
 	int _size = (sz);					\
-	int *_tab = (tab);					\
+	int __user *_tab = (tab);					\
 								\
 	if (write + _size > mask) {				\
 		int i = (mask+1) - write;			\

drivers/char/drm/radeon_irq.c

@@ -187,7 +187,7 @@ int radeon_irq_emit( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( emit, (drm_radeon_irq_emit_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( emit, (drm_radeon_irq_emit_t __user *)data,
 				  sizeof(emit) );
 
 	result = radeon_emit_irq( dev );
@@ -214,7 +214,7 @@ int radeon_irq_wait( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_radeon_irq_wait_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_radeon_irq_wait_t __user*)data,
 				  sizeof(irqwait) );
 
 	return radeon_wait_irq( dev, irqwait.irq_seq );

drivers/char/drm/radeon_mem.c

@@ -233,7 +233,7 @@ int radeon_mem_alloc( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( alloc, (drm_radeon_mem_alloc_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( alloc, (drm_radeon_mem_alloc_t __user *)data,
 				  sizeof(alloc) );
 
 	heap = get_heap( dev_priv, alloc.region );
@@ -275,7 +275,7 @@ int radeon_mem_free( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( memfree, (drm_radeon_mem_free_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( memfree, (drm_radeon_mem_free_t __user *)data,
 				  sizeof(memfree) );
 
 	heap = get_heap( dev_priv, memfree.region );
@@ -305,7 +305,7 @@ int radeon_mem_init_heap( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( initheap, (drm_radeon_mem_init_heap_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( initheap, (drm_radeon_mem_init_heap_t __user *)data,
 				  sizeof(initheap) );
 
 	heap = get_heap( dev_priv, initheap.region );

drivers/char/drm/radeon_state.c

@@ -63,7 +63,7 @@ static __inline__ int radeon_check_and_fixup_offset( drm_radeon_private_t *dev_p
 
 static __inline__ int radeon_check_and_fixup_offset_user( drm_radeon_private_t *dev_priv,
 							  drm_file_t *filp_priv,
-							  u32 *offset ) {
+							  u32 __user *offset ) {
 	u32 off;
 
 	DRM_GET_USER_UNCHECKED( off, offset );
@@ -79,7 +79,7 @@ static __inline__ int radeon_check_and_fixup_offset_user( drm_radeon_private_t *
 static __inline__ int radeon_check_and_fixup_packets( drm_radeon_private_t *dev_priv,
 						      drm_file_t *filp_priv,
 						      int id,
-						      u32 *data ) {
+						      u32 __user *data ) {
 	switch ( id ) {
 
 	case RADEON_EMIT_PP_MISC:
@@ -217,7 +217,8 @@ static __inline__ int radeon_check_and_fixup_packet3( drm_radeon_private_t *dev_
 						      drm_file_t *filp_priv,
 						      drm_radeon_cmd_buffer_t *cmdbuf,
 						      unsigned int *cmdsz ) {
-	u32 tmp[4], *cmd = ( u32* )cmdbuf->buf;
+	u32 tmp[4];
+	u32 __user *cmd = (u32 __user *)cmdbuf->buf;
 
 	if ( DRM_COPY_FROM_USER_UNCHECKED( tmp, cmd, sizeof( tmp ) ) ) {
 		DRM_ERROR( "Failed to copy data from user space\n" );
@@ -1339,7 +1340,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 	drm_buf_t *buf;
 	u32 format;
 	u32 *buffer;
-	const u8 *data;
+	const u8 __user *data;
 	int size, dwords, tex_width, blit_width;
 	u32 height;
 	int i;
@@ -1417,7 +1418,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		 * update them for a multi-pass texture blit.
 		 */
 		height = image->height;
-		data = (const u8 *)image->data;
+		data = (const u8 __user *)image->data;
 		
 		size = height * blit_width;
 
@@ -1499,7 +1500,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		/* Update the input parameters for next time */
 		image->y += height;
 		image->height -= height;
-		image->data = (const u8 *)image->data + size;
+		image->data = (const u8 __user *)image->data + size;
 	} while (image->height > 0);
 
 	/* Flush the pixel cache after the blit completes.  This ensures
@@ -1550,7 +1551,7 @@ int radeon_cp_clear( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( clear, (drm_radeon_clear_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( clear, (drm_radeon_clear_t __user *)data,
 			     sizeof(clear) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -1671,7 +1672,7 @@ int radeon_cp_vertex( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex_t __user *)data,
 			     sizeof(vertex) );
 
 	DRM_DEBUG( "pid=%d index=%d count=%d discard=%d\n",
@@ -1762,7 +1763,7 @@ int radeon_cp_indices( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( elts, (drm_radeon_indices_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( elts, (drm_radeon_indices_t __user *)data,
 			     sizeof(elts) );
 
 	DRM_DEBUG( "pid=%d index=%d start=%d end=%d discard=%d\n",
@@ -1853,7 +1854,7 @@ int radeon_cp_texture( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( tex, (drm_radeon_texture_t *)data, sizeof(tex) );
+	DRM_COPY_FROM_USER_IOCTL( tex, (drm_radeon_texture_t __user *)data, sizeof(tex) );
 
 	if ( tex.image == NULL ) {
 		DRM_ERROR( "null texture image!\n" );
@@ -1861,7 +1862,7 @@ int radeon_cp_texture( DRM_IOCTL_ARGS )
 	}
 
 	if ( DRM_COPY_FROM_USER( &image,
-			     (drm_radeon_tex_image_t *)tex.image,
+			     (drm_radeon_tex_image_t __user *)tex.image,
 			     sizeof(image) ) )
 		return DRM_ERR(EFAULT);
 
@@ -1883,7 +1884,7 @@ int radeon_cp_stipple( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_radeon_stipple_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_radeon_stipple_t __user *)data,
 			     sizeof(stipple) );
 
 	if ( DRM_COPY_FROM_USER( &mask, stipple.mask, 32 * sizeof(u32) ) )
@@ -1913,7 +1914,7 @@ int radeon_cp_indirect( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_radeon_indirect_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_radeon_indirect_t __user *)data,
 			     sizeof(indirect) );
 
 	DRM_DEBUG( "indirect: idx=%d s=%d e=%d d=%d\n",
@@ -1993,7 +1994,7 @@ int radeon_cp_vertex2( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex2_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex2_t __user *)data,
 			     sizeof(vertex) );
 
 	DRM_DEBUG( "pid=%d index=%d discard=%d\n",
@@ -2086,7 +2087,7 @@ static int radeon_emit_packets(
 {
 	int id = (int)header.packet.packet_id;
 	int sz, reg;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	RING_LOCALS;
    
 	if (id >= RADEON_MAX_STATE_PACKETS)
@@ -2121,7 +2122,7 @@ static __inline__ int radeon_emit_scalars(
 	drm_radeon_cmd_buffer_t *cmdbuf )
 {
 	int sz = header.scalars.count;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	int start = header.scalars.offset;
 	int stride = header.scalars.stride;
 	RING_LOCALS;
@@ -2145,7 +2146,7 @@ static __inline__ int radeon_emit_scalars2(
 	drm_radeon_cmd_buffer_t *cmdbuf )
 {
 	int sz = header.scalars.count;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	int start = ((unsigned int)header.scalars.offset) + 0x100;
 	int stride = header.scalars.stride;
 	RING_LOCALS;
@@ -2167,7 +2168,7 @@ static __inline__ int radeon_emit_vectors(
 	drm_radeon_cmd_buffer_t *cmdbuf )
 {
 	int sz = header.vectors.count;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	int start = header.vectors.offset;
 	int stride = header.vectors.stride;
 	RING_LOCALS;
@@ -2191,7 +2192,8 @@ static int radeon_emit_packet3( drm_device_t *dev,
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
 	unsigned int cmdsz;
-	int *cmd = (int *)cmdbuf->buf, ret;
+	int __user *cmd = (int __user *)cmdbuf->buf;
+	int ret;
 	RING_LOCALS;
 
 	DRM_DEBUG("\n");
@@ -2220,8 +2222,9 @@ static int radeon_emit_packet3_cliprect( drm_device_t *dev,
 	drm_radeon_private_t *dev_priv = dev->dev_private;
 	drm_clip_rect_t box;
 	unsigned int cmdsz;
-	int *cmd = (int *)cmdbuf->buf, ret;
-	drm_clip_rect_t *boxes = cmdbuf->boxes;
+	int __user *cmd = (int __user *)cmdbuf->buf;
+	int ret;
+	drm_clip_rect_t __user *boxes = cmdbuf->boxes;
 	int i = 0;
 	RING_LOCALS;
 
@@ -2325,7 +2328,7 @@ int radeon_cp_cmdbuf( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_radeon_cmd_buffer_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_radeon_cmd_buffer_t __user *)data,
 			     sizeof(cmdbuf) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -2344,7 +2347,7 @@ int radeon_cp_cmdbuf( DRM_IOCTL_ARGS )
 
 	while ( cmdbuf.bufsz >= sizeof(header) ) {
 		
-		if (DRM_GET_USER_UNCHECKED( header.i, (int *)cmdbuf.buf )) {
+		if (DRM_GET_USER_UNCHECKED( header.i, (int __user *)cmdbuf.buf )) {
 			DRM_ERROR("__get_user %p\n", cmdbuf.buf);
 			return DRM_ERR(EFAULT);
 		}
@@ -2455,7 +2458,7 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_radeon_getparam_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_radeon_getparam_t __user *)data,
 			     sizeof(param) );
 
 	DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID );
@@ -2530,7 +2533,7 @@ int radeon_cp_setparam( DRM_IOCTL_ARGS ) {
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( sp, ( drm_radeon_setparam_t* )data,
+	DRM_COPY_FROM_USER_IOCTL( sp, ( drm_radeon_setparam_t __user * )data,
 				  sizeof( sp ) );
 
 	switch( sp.param ) {

drivers/char/drm/sis_mm.c

@@ -155,7 +155,7 @@ int sis_fb_init( DRM_IOCTL_ARGS )
 	drm_sis_private_t *dev_priv = dev->dev_private;
 	drm_sis_fb_t fb;
 
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_fb_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_fb_t __user *)data, sizeof(fb));
 
 	if (dev_priv == NULL) {
 		dev->dev_private = DRM(calloc)(1, sizeof(drm_sis_private_t),
@@ -179,6 +179,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 {
 	DRM_DEVICE;
 	drm_sis_private_t *dev_priv = dev->dev_private;
+	drm_sis_mem_t __user *argp = (void __user *)data;
 	drm_sis_mem_t fb;
 	PMemBlock block;
 	int retval = 0;
@@ -186,7 +187,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->FBHeap == NULL)
 		return DRM_ERR(EINVAL);
   
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, argp, sizeof(fb));
   
 	block = mmAllocMem(dev_priv->FBHeap, fb.size, 0, 0);
 	if (block) {
@@ -204,7 +205,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 		fb.free = 0;
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, fb, sizeof(fb));
+	DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb));
 
 	DRM_DEBUG("alloc fb, size = %d, offset = %d\n", fb.size, fb.offset);
 
@@ -220,7 +221,7 @@ int sis_fb_free( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->FBHeap == NULL)
 		return DRM_ERR(EINVAL);
 
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t __user *)data, sizeof(fb));
 
 	if (!mmBlockInHeap(dev_priv->FBHeap, (PMemBlock)fb.free))
 		return DRM_ERR(EINVAL);
@@ -255,7 +256,7 @@ int sis_ioctl_agp_init( DRM_IOCTL_ARGS )
 	if (dev_priv->AGPHeap != NULL)
 		return DRM_ERR(EINVAL);
 
-	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_agp_t *)data, sizeof(agp));
+	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_agp_t __user *)data, sizeof(agp));
 
 	dev_priv->AGPHeap = mmInit(agp.offset, agp.size);
 
@@ -268,6 +269,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS )
 {
 	DRM_DEVICE;
 	drm_sis_private_t *dev_priv = dev->dev_private;
+	drm_sis_mem_t __user *argp = (void __user *)data;
 	drm_sis_mem_t agp;
 	PMemBlock block;
 	int retval = 0;
@@ -275,7 +277,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->AGPHeap == NULL)
 		return DRM_ERR(EINVAL);
   
-	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t *)data, sizeof(agp));
+	DRM_COPY_FROM_USER_IOCTL(agp, argp, sizeof(agp));
   
 	block = mmAllocMem(dev_priv->AGPHeap, agp.size, 0, 0);
 	if (block) {
@@ -293,7 +295,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS )
 		agp.free = 0;
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, agp, sizeof(agp));
+	DRM_COPY_TO_USER_IOCTL(argp, agp, sizeof(agp));
 
 	DRM_DEBUG("alloc agp, size = %d, offset = %d\n", agp.size, agp.offset);
 
@@ -309,7 +311,7 @@ int sis_ioctl_agp_free( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->AGPHeap == NULL)
 		return DRM_ERR(EINVAL);
 
-	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t *)data, sizeof(agp));
+	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t __user *)data, sizeof(agp));
 
 	if (!mmBlockInHeap(dev_priv->AGPHeap, (PMemBlock)agp.free))
 		return DRM_ERR(EINVAL);