1 files changed, 57 insertions, 108 deletions

diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index e7253874fa8f..856774fbe025 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -332,34 +332,24 @@ int drm_addmap(struct drm_device * dev, unsigned int offset,
 
 EXPORT_SYMBOL(drm_addmap);
 
-int drm_addmap_ioctl(struct inode *inode, struct drm_file *file_priv,
-		     unsigned int cmd, unsigned long arg)
+int drm_addmap_ioctl(struct drm_device *dev, void *data,
+		     struct drm_file *file_priv)
 {
-	struct drm_device *dev = file_priv->head->dev;
-	struct drm_map map;
+	struct drm_map *map = data;
 	struct drm_map_list *maplist;
-	struct drm_map __user *argp = (void __user *)arg;
 	int err;
 
-	if (copy_from_user(&map, argp, sizeof(map))) {
-		return -EFAULT;
-	}
-
-	if (!(capable(CAP_SYS_ADMIN) || map.type == _DRM_AGP))
+	if (!(capable(CAP_SYS_ADMIN) || map->type == _DRM_AGP))
 		return -EPERM;
 
-	err = drm_addmap_core(dev, map.offset, map.size, map.type, map.flags,
-			      &maplist);
+	err = drm_addmap_core(dev, map->offset, map->size, map->type,
+			      map->flags, &maplist);
 
 	if (err)
 		return err;
 
-	if (copy_to_user(argp, maplist->map, sizeof(struct drm_map)))
-		return -EFAULT;
-
 	/* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */
-	if (put_user((void *)(unsigned long)maplist->user_token, &argp->handle))
-		return -EFAULT;
+	map->handle = (void *)(unsigned long)maplist->user_token;
 	return 0;
 }
 
@@ -449,23 +439,18 @@ int drm_rmmap(struct drm_device *dev, drm_local_map_t *map)
  * gets used by drivers that the server doesn't need to care about.  This seems
  * unlikely.
  */
-int drm_rmmap_ioctl(struct inode *inode, struct drm_file *file_priv,
-		    unsigned int cmd, unsigned long arg)
+int drm_rmmap_ioctl(struct drm_device *dev, void *data,
+		    struct drm_file *file_priv)
 {
-	struct drm_device *dev = file_priv->head->dev;
-	struct drm_map request;
+	struct drm_map *request = data;
 	drm_local_map_t *map = NULL;
 	struct drm_map_list *r_list;
 	int ret;
 
-	if (copy_from_user(&request, (struct drm_map __user *) arg, sizeof(request))) {
-		return -EFAULT;
-	}
-
 	mutex_lock(&dev->struct_mutex);
 	list_for_each_entry(r_list, &dev->maplist, head) {
 		if (r_list->map &&
-		    r_list->user_token == (unsigned long)request.handle &&
+		    r_list->user_token == (unsigned long)request->handle &&
 		    r_list->map->flags & _DRM_REMOVABLE) {
 			map = r_list->map;
 			break;
@@ -1280,37 +1265,27 @@ static int drm_addbufs_fb(struct drm_device * dev, struct drm_buf_desc * request
  * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent
  * PCI memory respectively.
  */
-int drm_addbufs(struct inode *inode, struct drm_file *file_priv,
-		unsigned int cmd, unsigned long arg)
+int drm_addbufs(struct drm_device *dev, void *data,
+		struct drm_file *file_priv)
 {
-	struct drm_buf_desc request;
-	struct drm_device *dev = file_priv->head->dev;
+	struct drm_buf_desc *request = data;
 	int ret;
 
 	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
 		return -EINVAL;
 
-	if (copy_from_user(&request, (struct drm_buf_desc __user *) arg,
-			   sizeof(request)))
-		return -EFAULT;
-
 #if __OS_HAS_AGP
-	if (request.flags & _DRM_AGP_BUFFER)
-		ret = drm_addbufs_agp(dev, &request);
+	if (request->flags & _DRM_AGP_BUFFER)
+		ret = drm_addbufs_agp(dev, request);
 	else
 #endif
-	if (request.flags & _DRM_SG_BUFFER)
-		ret = drm_addbufs_sg(dev, &request);
-	else if (request.flags & _DRM_FB_BUFFER)
-		ret = drm_addbufs_fb(dev, &request);
+	if (request->flags & _DRM_SG_BUFFER)
+		ret = drm_addbufs_sg(dev, request);
+	else if (request->flags & _DRM_FB_BUFFER)
+		ret = drm_addbufs_fb(dev, request);
 	else
-		ret = drm_addbufs_pci(dev, &request);
+		ret = drm_addbufs_pci(dev, request);
 
-	if (ret == 0) {
-		if (copy_to_user((void __user *)arg, &request, sizeof(request))) {
-			ret = -EFAULT;
-		}
-	}
 	return ret;
 }
 
@@ -1331,13 +1306,11 @@ int drm_addbufs(struct inode *inode, struct drm_file *file_priv,
  * lock, preventing of allocating more buffers after this call. Information
  * about each requested buffer is then copied into user space.
  */
-int drm_infobufs(struct inode *inode, struct drm_file *file_priv,
-		 unsigned int cmd, unsigned long arg)
+int drm_infobufs(struct drm_device *dev, void *data,
+		 struct drm_file *file_priv)
 {
-	struct drm_device *dev = file_priv->head->dev;
 	struct drm_device_dma *dma = dev->dma;
-	struct drm_buf_info request;
-	struct drm_buf_info __user *argp = (void __user *)arg;
+	struct drm_buf_info *request = data;
 	int i;
 	int count;
 
@@ -1355,9 +1328,6 @@ int drm_infobufs(struct inode *inode, struct drm_file *file_priv,
 	++dev->buf_use;		/* Can't allocate more after this call */
 	spin_unlock(&dev->count_lock);
 
-	if (copy_from_user(&request, argp, sizeof(request)))
-		return -EFAULT;
-
 	for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
 		if (dma->bufs[i].buf_count)
 			++count;
@@ -1365,11 +1335,11 @@ int drm_infobufs(struct inode *inode, struct drm_file *file_priv,
 
 	DRM_DEBUG("count = %d\n", count);
 
-	if (request.count >= count) {
+	if (request->count >= count) {
 		for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
 			if (dma->bufs[i].buf_count) {
 				struct drm_buf_desc __user *to =
-				    &request.list[count];
+				    &request->list[count];
 				struct drm_buf_entry *from = &dma->bufs[i];
 				struct drm_freelist *list = &dma->bufs[i].freelist;
 				if (copy_to_user(&to->count,
@@ -1396,10 +1366,7 @@ int drm_infobufs(struct inode *inode, struct drm_file *file_priv,
 			}
 		}
 	}
-	request.count = count;
-
-	if (copy_to_user(argp, &request, sizeof(request)))
-		return -EFAULT;
+	request->count = count;
 
 	return 0;
 }
@@ -1418,12 +1385,11 @@ int drm_infobufs(struct inode *inode, struct drm_file *file_priv,
  *
  * \note This ioctl is deprecated and mostly never used.
  */
-int drm_markbufs(struct inode *inode, struct drm_file *file_priv,
-		 unsigned int cmd, unsigned long arg)
+int drm_markbufs(struct drm_device *dev, void *data,
+		 struct drm_file *file_priv)
 {
-	struct drm_device *dev = file_priv->head->dev;
 	struct drm_device_dma *dma = dev->dma;
-	struct drm_buf_desc request;
+	struct drm_buf_desc *request = data;
 	int order;
 	struct drm_buf_entry *entry;
 
@@ -1433,24 +1399,20 @@ int drm_markbufs(struct inode *inode, struct drm_file *file_priv,
 	if (!dma)
 		return -EINVAL;
 
-	if (copy_from_user(&request,
-			   (struct drm_buf_desc __user *) arg, sizeof(request)))
-		return -EFAULT;
-
 	DRM_DEBUG("%d, %d, %d\n",
-		  request.size, request.low_mark, request.high_mark);
-	order = drm_order(request.size);
+		  request->size, request->low_mark, request->high_mark);
+	order = drm_order(request->size);
 	if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 		return -EINVAL;
 	entry = &dma->bufs[order];
 
-	if (request.low_mark < 0 || request.low_mark > entry->buf_count)
+	if (request->low_mark < 0 || request->low_mark > entry->buf_count)
 		return -EINVAL;
-	if (request.high_mark < 0 || request.high_mark > entry->buf_count)
+	if (request->high_mark < 0 || request->high_mark > entry->buf_count)
 		return -EINVAL;
 
-	entry->freelist.low_mark = request.low_mark;
-	entry->freelist.high_mark = request.high_mark;
+	entry->freelist.low_mark = request->low_mark;
+	entry->freelist.high_mark = request->high_mark;
 
 	return 0;
 }
@@ -1467,12 +1429,11 @@ int drm_markbufs(struct inode *inode, struct drm_file *file_priv,
  * Calls free_buffer() for each used buffer.
  * This function is primarily used for debugging.
  */
-int drm_freebufs(struct inode *inode, struct drm_file *file_priv,
-		 unsigned int cmd, unsigned long arg)
+int drm_freebufs(struct drm_device *dev, void *data,
+		 struct drm_file *file_priv)
 {
-	struct drm_device *dev = file_priv->head->dev;
 	struct drm_device_dma *dma = dev->dma;
-	struct drm_buf_free request;
+	struct drm_buf_free *request = data;
 	int i;
 	int idx;
 	struct drm_buf *buf;
@@ -1483,13 +1444,9 @@ int drm_freebufs(struct inode *inode, struct drm_file *file_priv,
 	if (!dma)
 		return -EINVAL;
 
-	if (copy_from_user(&request,
-			   (struct drm_buf_free __user *) arg, sizeof(request)))
-		return -EFAULT;
-
-	DRM_DEBUG("%d\n", request.count);
-	for (i = 0; i < request.count; i++) {
-		if (copy_from_user(&idx, &request.list[i], sizeof(idx)))
+	DRM_DEBUG("%d\n", request->count);
+	for (i = 0; i < request->count; i++) {
+		if (copy_from_user(&idx, &request->list[i], sizeof(idx)))
 			return -EFAULT;
 		if (idx < 0 || idx >= dma->buf_count) {
 			DRM_ERROR("Index %d (of %d max)\n",
@@ -1522,17 +1479,15 @@ int drm_freebufs(struct inode *inode, struct drm_file *file_priv,
  * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls
  * drm_mmap_dma().
  */
-int drm_mapbufs(struct inode *inode, struct drm_file *file_priv,
-		unsigned int cmd, unsigned long arg)
+int drm_mapbufs(struct drm_device *dev, void *data,
+	        struct drm_file *file_priv)
 {
-	struct drm_device *dev = file_priv->head->dev;
 	struct drm_device_dma *dma = dev->dma;
-	struct drm_buf_map __user *argp = (void __user *)arg;
 	int retcode = 0;
 	const int zero = 0;
 	unsigned long virtual;
 	unsigned long address;
-	struct drm_buf_map request;
+	struct drm_buf_map *request = data;
 	int i;
 
 	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
@@ -1549,10 +1504,7 @@ int drm_mapbufs(struct inode *inode, struct drm_file *file_priv,
 	dev->buf_use++;		/* Can't allocate more after this call */
 	spin_unlock(&dev->count_lock);
 
-	if (copy_from_user(&request, argp, sizeof(request)))
-		return -EFAULT;
-
-	if (request.count >= dma->buf_count) {
+	if (request->count >= dma->buf_count) {
 		if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP))
 		    || (drm_core_check_feature(dev, DRIVER_SG)
 			&& (dma->flags & _DRM_DMA_USE_SG))
@@ -1565,11 +1517,11 @@ int drm_mapbufs(struct inode *inode, struct drm_file *file_priv,
 				retcode = -EINVAL;
 				goto done;
 			}
-
 			down_write(&current->mm->mmap_sem);
 			virtual = do_mmap(file_priv->filp, 0, map->size,
 					  PROT_READ | PROT_WRITE,
-					  MAP_SHARED, token);
+					  MAP_SHARED,
+					  token);
 			up_write(&current->mm->mmap_sem);
 		} else {
 			down_write(&current->mm->mmap_sem);
@@ -1583,28 +1535,28 @@ int drm_mapbufs(struct inode *inode, struct drm_file *file_priv,
 			retcode = (signed long)virtual;
 			goto done;
 		}
-		request.virtual = (void __user *)virtual;
+		request->virtual = (void __user *)virtual;
 
 		for (i = 0; i < dma->buf_count; i++) {
-			if (copy_to_user(&request.list[i].idx,
+			if (copy_to_user(&request->list[i].idx,
 					 &dma->buflist[i]->idx,
-					 sizeof(request.list[0].idx))) {
+					 sizeof(request->list[0].idx))) {
 				retcode = -EFAULT;
 				goto done;
 			}
-			if (copy_to_user(&request.list[i].total,
+			if (copy_to_user(&request->list[i].total,
 					 &dma->buflist[i]->total,
-					 sizeof(request.list[0].total))) {
+					 sizeof(request->list[0].total))) {
 				retcode = -EFAULT;
 				goto done;
 			}
-			if (copy_to_user(&request.list[i].used,
+			if (copy_to_user(&request->list[i].used,
 					 &zero, sizeof(zero))) {
 				retcode = -EFAULT;
 				goto done;
 			}
 			address = virtual + dma->buflist[i]->offset;	/* *** */
-			if (copy_to_user(&request.list[i].address,
+			if (copy_to_user(&request->list[i].address,
 					 &address, sizeof(address))) {
 				retcode = -EFAULT;
 				goto done;
@@ -1612,11 +1564,8 @@ int drm_mapbufs(struct inode *inode, struct drm_file *file_priv,
 		}
 	}
       done:
-	request.count = dma->buf_count;
-	DRM_DEBUG("%d buffers, retcode = %d\n", request.count, retcode);
-
-	if (copy_to_user(argp, &request, sizeof(request)))
-		return -EFAULT;
+	request->count = dma->buf_count;
+	DRM_DEBUG("%d buffers, retcode = %d\n", request->count, retcode);
 
 	return retcode;
 }