The radeon DRM wasn't passing sparse checking in the kernel, this fixes it

    by adding a new kernel internal cmd buffer type, that has no userspace
    members, and passes it around.

3 files changed, 54 insertions, 47 deletions

diff --git a/shared-core/r300_cmdbuf.c b/shared-core/r300_cmdbuf.c
index 475ce1da..acfd4f87 100644
--- a/shared-core/r300_cmdbuf.c
+++ b/shared-core/r300_cmdbuf.c
@@ -55,7 +55,7 @@ static const int r300_cliprect_cntl[4] = {
  * buffer, starting with index n.
  */
 static int r300_emit_cliprects(drm_radeon_private_t* dev_priv,
-			       drm_radeon_cmd_buffer_t* cmdbuf,
+			       drm_radeon_kcmd_buffer_t* cmdbuf,
 			       int n)
 {
 	drm_clip_rect_t box;
@@ -125,7 +125,7 @@ static int r300_emit_cliprects(drm_radeon_private_t* dev_priv,
 	return 0;
 }
 
-u8  r300_reg_flags[0x10000>>2];
+static u8 r300_reg_flags[0x10000>>2];
 
 
 void r300_init_reg_flags(void)
@@ -249,8 +249,8 @@ static __inline__ int r300_check_offset(drm_radeon_private_t* dev_priv, u32 offs
 	return 1;
 }
 
-static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t* dev_priv,
-						drm_radeon_cmd_buffer_t* cmdbuf,
+static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *dev_priv,
+						drm_radeon_kcmd_buffer_t *cmdbuf,
 						drm_r300_cmd_header_t header)
 {
 	int reg;
@@ -267,7 +267,7 @@ static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t*
 		return DRM_ERR(EINVAL);
 		}
 	for(i=0;i<sz;i++){
-		values[i]=((int __user*)cmdbuf->buf)[i];
+		values[i]=((int *)cmdbuf->buf)[i];
 		switch(r300_reg_flags[(reg>>2)+i]){
 		case MARK_SAFE:
 			break;
@@ -300,9 +300,9 @@ static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t*
  *
  * Note that checks are performed on contents and addresses of the registers
  */
-static __inline__ int r300_emit_packet0(drm_radeon_private_t* dev_priv,
-						drm_radeon_cmd_buffer_t* cmdbuf,
-						drm_r300_cmd_header_t header)
+static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
+					drm_radeon_kcmd_buffer_t *cmdbuf,
+					drm_r300_cmd_header_t header)
 {
 	int reg;
 	int sz;
@@ -330,7 +330,7 @@ static __inline__ int r300_emit_packet0(drm_radeon_private_t* dev_priv,
 
 	BEGIN_RING(1+sz);
 	OUT_RING( CP_PACKET0( reg, sz-1 ) );
-	OUT_RING_TABLE( (int __user*)cmdbuf->buf, sz );
+	OUT_RING_TABLE( (int *)cmdbuf->buf, sz );
 	ADVANCE_RING();
 
 	cmdbuf->buf += sz*4;
@@ -345,8 +345,8 @@ static __inline__ int r300_emit_packet0(drm_radeon_private_t* dev_priv,
  * the graphics card.
  * Called by r300_do_cp_cmdbuf.
  */
-static __inline__ int r300_emit_vpu(drm_radeon_private_t* dev_priv,
-				    drm_radeon_cmd_buffer_t* cmdbuf,
+static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
+				    drm_radeon_kcmd_buffer_t *cmdbuf,
 				    drm_r300_cmd_header_t header)
 {
 	int sz;
@@ -368,7 +368,7 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t* dev_priv,
 	OUT_RING_REG( R300_VAP_PVS_WAITIDLE, 0 );
 	OUT_RING_REG( R300_VAP_PVS_UPLOAD_ADDRESS, addr );
 	OUT_RING( CP_PACKET0_TABLE( R300_VAP_PVS_UPLOAD_DATA, sz*4 - 1 ) );
-	OUT_RING_TABLE( (int __user*)cmdbuf->buf, sz*4 );
+	OUT_RING_TABLE((int *)cmdbuf->buf, sz*4);
 
 	ADVANCE_RING();
 
@@ -383,8 +383,8 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t* dev_priv,
  * Emit a clear packet from userspace.
  * Called by r300_emit_packet3.
  */
-static __inline__ int r300_emit_clear(drm_radeon_private_t* dev_priv,
-				      drm_radeon_cmd_buffer_t* cmdbuf)
+static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
+				      drm_radeon_kcmd_buffer_t *cmdbuf)
 {
 	RING_LOCALS;
 
@@ -395,7 +395,7 @@ static __inline__ int r300_emit_clear(drm_radeon_private_t* dev_priv,
 	OUT_RING( CP_PACKET3( R200_3D_DRAW_IMMD_2, 8 ) );
 	OUT_RING( R300_PRIM_TYPE_POINT|R300_PRIM_WALK_RING|
 	          (1<<R300_PRIM_NUM_VERTICES_SHIFT) );
-	OUT_RING_TABLE( (int __user*)cmdbuf->buf, 8 );
+	OUT_RING_TABLE((int *)cmdbuf->buf, 8);
 	ADVANCE_RING();
 
 	cmdbuf->buf += 8*4;
@@ -404,9 +404,9 @@ static __inline__ int r300_emit_clear(drm_radeon_private_t* dev_priv,
 	return 0;
 }
 
-static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t* dev_priv,
-				      drm_radeon_cmd_buffer_t* cmdbuf,
-				      u32 header)
+static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
+					       drm_radeon_kcmd_buffer_t *cmdbuf,
+					       u32 header)
 {
 	int count, i,k;
 	#define MAX_ARRAY_PACKET  64
@@ -464,8 +464,8 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t* dev_priv,
 	return 0;
 }
 
-static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t* dev_priv,
-				      drm_radeon_cmd_buffer_t* cmdbuf)
+static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
+				      drm_radeon_kcmd_buffer_t *cmdbuf)
 {
 	u32 header;
 	int count;
@@ -478,7 +478,7 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t* dev_priv,
 	   We need to be smarter. */
 
 	/* obtain first word - actual packet3 header */
-	header = *(u32 __user*)cmdbuf->buf;
+	header = *(u32 *)cmdbuf->buf;
 
 	/* Is it packet 3 ? */
 	if( (header>>30)!=0x3 ) {
@@ -516,7 +516,7 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t* dev_priv,
 
 	BEGIN_RING(count+2);
 	OUT_RING(header);
-	OUT_RING_TABLE( (int __user*)(cmdbuf->buf+4), count+1);
+	OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 	ADVANCE_RING();
 
 	cmdbuf->buf += (count+2)*4;
@@ -530,13 +530,13 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t* dev_priv,
  * Emit a rendering packet3 from userspace.
  * Called by r300_do_cp_cmdbuf.
  */
-static __inline__ int r300_emit_packet3(drm_radeon_private_t* dev_priv,
-					drm_radeon_cmd_buffer_t* cmdbuf,
+static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
+					drm_radeon_kcmd_buffer_t *cmdbuf,
 					drm_r300_cmd_header_t header)
 {
 	int n;
 	int ret;
-	char __user* orig_buf = cmdbuf->buf;
+	char *orig_buf = cmdbuf->buf;
 	int orig_bufsz = cmdbuf->bufsz;
 
 	/* This is a do-while-loop so that we run the interior at least once,
@@ -636,9 +636,9 @@ static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf)
  * Called by the ioctl handler function radeon_cp_cmdbuf.
  */
 int r300_do_cp_cmdbuf(drm_device_t* dev,
-			  DRMFILE filp,
+		      DRMFILE filp,
 		      drm_file_t* filp_priv,
-		      drm_radeon_cmd_buffer_t* cmdbuf)
+		      drm_radeon_kcmd_buffer_t* cmdbuf)
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
         drm_device_dma_t *dma = dev->dma;
diff --git a/shared-core/radeon_drv.h b/shared-core/radeon_drv.h
index 615afc78..795e3691 100644
--- a/shared-core/radeon_drv.h
+++ b/shared-core/radeon_drv.h
@@ -277,6 +277,13 @@ typedef struct drm_radeon_buf_priv {
 	u32 age;
 } drm_radeon_buf_priv_t;
 
+typedef struct drm_radeon_kcmd_buffer {
+	int bufsz;
+	char *buf;
+	int nbox;
+	drm_clip_rect_t __user *boxes;
+} drm_radeon_kcmd_buffer_t;
+
 extern int radeon_no_wb;
 extern drm_ioctl_desc_t radeon_ioctls[];
 extern int radeon_max_ioctl;
@@ -330,10 +337,9 @@ extern long radeon_compat_ioctl(struct file *filp, unsigned int cmd,
 /* r300_cmdbuf.c */
 extern void r300_init_reg_flags(void);
 
-extern int r300_do_cp_cmdbuf( drm_device_t* dev,
-				  DRMFILE filp,
-			      drm_file_t* filp_priv,
-			      drm_radeon_cmd_buffer_t* cmdbuf );
+extern int r300_do_cp_cmdbuf(drm_device_t *dev, DRMFILE filp,
+			     drm_file_t* filp_priv,
+			     drm_radeon_kcmd_buffer_t* cmdbuf);
 
 /* Flags for stats.boxes
  */
diff --git a/shared-core/radeon_state.c b/shared-core/radeon_state.c
index 3682c68c..a25b177c 100644
--- a/shared-core/radeon_state.c
+++ b/shared-core/radeon_state.c
@@ -67,7 +67,7 @@ static __inline__ int radeon_check_and_fixup_offset(drm_radeon_private_t *
 static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
 						     dev_priv,
 						     drm_file_t * filp_priv,
-						     int id, u32 __user * data)
+						     int id, u32 *data)
 {
 	switch (id) {
 
@@ -232,8 +232,8 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
 
 static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
 						     dev_priv,
-						     drm_file_t * filp_priv,
-						     drm_radeon_cmd_buffer_t *
+						     drm_file_t *filp_priv,
+						     drm_radeon_kcmd_buffer_t *
 						     cmdbuf,
 						     unsigned int *cmdsz)
 {
@@ -2512,7 +2512,7 @@ static int radeon_cp_vertex2(DRM_IOCTL_ARGS)
 static int radeon_emit_packets(drm_radeon_private_t * dev_priv,
 			       drm_file_t * filp_priv,
 			       drm_radeon_cmd_header_t header,
-			       drm_radeon_cmd_buffer_t * cmdbuf)
+			       drm_radeon_kcmd_buffer_t * cmdbuf)
 {
 	int id = (int)header.packet.packet_id;
 	int sz, reg;
@@ -2545,9 +2545,9 @@ static int radeon_emit_packets(drm_radeon_private_t * dev_priv,
 	return 0;
 }
 
-static __inline__ int radeon_emit_scalars(drm_radeon_private_t * dev_priv,
+static __inline__ int radeon_emit_scalars(drm_radeon_private_t *dev_priv,
 					  drm_radeon_cmd_header_t header,
-					  drm_radeon_cmd_buffer_t * cmdbuf)
+					  drm_radeon_kcmd_buffer_t *cmdbuf)
 {
 	int sz = header.scalars.count;
 	int start = header.scalars.offset;
@@ -2567,9 +2567,9 @@ static __inline__ int radeon_emit_scalars(drm_radeon_private_t * dev_priv,
 
 /* God this is ugly
  */
-static __inline__ int radeon_emit_scalars2(drm_radeon_private_t * dev_priv,
+static __inline__ int radeon_emit_scalars2(drm_radeon_private_t *dev_priv,
 					   drm_radeon_cmd_header_t header,
-					   drm_radeon_cmd_buffer_t * cmdbuf)
+					   drm_radeon_kcmd_buffer_t *cmdbuf)
 {
 	int sz = header.scalars.count;
 	int start = ((unsigned int)header.scalars.offset) + 0x100;
@@ -2587,9 +2587,9 @@ static __inline__ int radeon_emit_scalars2(drm_radeon_private_t * dev_priv,
 	return 0;
 }
 
-static __inline__ int radeon_emit_vectors(drm_radeon_private_t * dev_priv,
+static __inline__ int radeon_emit_vectors(drm_radeon_private_t *dev_priv,
 					  drm_radeon_cmd_header_t header,
-					  drm_radeon_cmd_buffer_t * cmdbuf)
+					  drm_radeon_kcmd_buffer_t *cmdbuf)
 {
 	int sz = header.vectors.count;
 	int start = header.vectors.offset;
@@ -2610,7 +2610,7 @@ static __inline__ int radeon_emit_vectors(drm_radeon_private_t * dev_priv,
 
 static int radeon_emit_packet3(drm_device_t * dev,
 			       drm_file_t * filp_priv,
-			       drm_radeon_cmd_buffer_t * cmdbuf)
+			       drm_radeon_kcmd_buffer_t * cmdbuf)
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
 	unsigned int cmdsz;
@@ -2634,9 +2634,9 @@ static int radeon_emit_packet3(drm_device_t * dev,
 	return 0;
 }
 
-static int radeon_emit_packet3_cliprect(drm_device_t * dev,
-					drm_file_t * filp_priv,
-					drm_radeon_cmd_buffer_t * cmdbuf,
+static int radeon_emit_packet3_cliprect(drm_device_t *dev,
+					drm_file_t *filp_priv,
+					drm_radeon_kcmd_buffer_t *cmdbuf,
 					int orig_nbox)
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
@@ -2733,7 +2733,7 @@ static int radeon_cp_cmdbuf(DRM_IOCTL_ARGS)
 	drm_device_dma_t *dma = dev->dma;
 	drm_buf_t *buf = NULL;
 	int idx;
-	drm_radeon_cmd_buffer_t cmdbuf;
+	drm_radeon_kcmd_buffer_t cmdbuf;
 	drm_radeon_cmd_header_t header;
 	int orig_nbox, orig_bufsz;
 	char *kbuf = NULL;
@@ -2767,7 +2767,8 @@ static int radeon_cp_cmdbuf(DRM_IOCTL_ARGS)
 		kbuf = drm_alloc(cmdbuf.bufsz, DRM_MEM_DRIVER);
 		if (kbuf == NULL)
 			return DRM_ERR(ENOMEM);
-		if (DRM_COPY_FROM_USER(kbuf, cmdbuf.buf, cmdbuf.bufsz)) {
+		if (DRM_COPY_FROM_USER(kbuf, (void __user *)cmdbuf.buf,
+				       cmdbuf.bufsz)) {
 			drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);
 			return DRM_ERR(EFAULT);
 		}