first set of __user annotations from kernel (Al Viro)

15 files changed, 114 insertions, 106 deletions

diff --git a/linux/drmP.h b/linux/drmP.h
index d3564d06..066b185d 100644
--- a/linux/drmP.h
+++ b/linux/drmP.h
@@ -740,7 +740,7 @@ extern int	     DRM(mmap_dma)(struct file *filp,
 				   struct vm_area_struct *vma);
 extern int	     DRM(mmap)(struct file *filp, struct vm_area_struct *vma);
 extern unsigned int  DRM(poll)(struct file *filp, struct poll_table_struct *wait);
-extern ssize_t       DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off);
+extern ssize_t       DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off);
 
 				/* Memory management support (drm_memory.h) */
 extern void	     DRM(mem_init)(void);
diff --git a/linux/drm_agpsupport.h b/linux/drm_agpsupport.h
index f83651af..c4f0e465 100644
--- a/linux/drm_agpsupport.h
+++ b/linux/drm_agpsupport.h
@@ -80,7 +80,7 @@ int DRM(agp_info)(struct inode *inode, struct file *filp,
 	info.id_vendor         = kern->device->vendor;
 	info.id_device         = kern->device->device;
 
-	if (copy_to_user((drm_agp_info_t *)arg, &info, sizeof(info)))
+	if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info)))
 		return -EFAULT;
 	return 0;
 }
@@ -178,7 +178,7 @@ int DRM(agp_enable)(struct inode *inode, struct file *filp,
 	if (!dev->agp || !dev->agp->acquired || !drm_agp->enable)
 		return -EINVAL;
 
-	if (copy_from_user(&mode, (drm_agp_mode_t *)arg, sizeof(mode)))
+	if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode)))
 		return -EFAULT;
 
 	dev->agp->mode    = mode.mode;
@@ -210,10 +210,11 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp,
 	DRM_AGP_MEM      *memory;
 	unsigned long    pages;
 	u32 		 type;
+	drm_agp_buffer_t __user *argp = (void __user *)arg;
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(alloc)(sizeof(*entry), DRM_MEM_AGPLISTS)))
 		return -ENOMEM;
@@ -241,7 +242,7 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp,
 	request.handle   = entry->handle;
 	request.physical = memory->physical;
 
-	if (copy_to_user((drm_agp_buffer_t *)arg, &request, sizeof(request))) {
+	if (copy_to_user(argp, &request, sizeof(request))) {
 		dev->agp->memory       = entry->next;
 		dev->agp->memory->prev = NULL;
 		DRM(free_agp)(memory, pages);
@@ -295,7 +296,7 @@ int DRM(agp_unbind)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
@@ -332,7 +333,7 @@ int DRM(agp_bind)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired || !drm_agp->bind_memory)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
@@ -371,7 +372,7 @@ int DRM(agp_free)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_buffer_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
diff --git a/linux/drm_auth.h b/linux/drm_auth.h
index e027303a..a6d174cd 100644
--- a/linux/drm_auth.h
+++ b/linux/drm_auth.h
@@ -195,7 +195,7 @@ int DRM(getmagic)(struct inode *inode, struct file *filp,
 	}
 
 	DRM_DEBUG("%u\n", auth.magic);
-	if (copy_to_user((drm_auth_t *)arg, &auth, sizeof(auth)))
+	if (copy_to_user((drm_auth_t __user *)arg, &auth, sizeof(auth)))
 		return -EFAULT;
 	return 0;
 }
@@ -219,7 +219,7 @@ int DRM(authmagic)(struct inode *inode, struct file *filp,
 	drm_auth_t	   auth;
 	drm_file_t	   *file;
 
-	if (copy_from_user(&auth, (drm_auth_t *)arg, sizeof(auth)))
+	if (copy_from_user(&auth, (drm_auth_t __user *)arg, sizeof(auth)))
 		return -EFAULT;
 	DRM_DEBUG("%u\n", auth.magic);
 	if ((file = DRM(find_file)(dev, auth.magic))) {
diff --git a/linux/drm_bufs.h b/linux/drm_bufs.h
index 38ddb790..7270ff4a 100644
--- a/linux/drm_bufs.h
+++ b/linux/drm_bufs.h
@@ -71,9 +71,10 @@ int DRM(order)( unsigned long size )
 	int order;
 	unsigned long tmp;
 
-	for ( order = 0, tmp = size ; tmp >>= 1 ; ++order );
+	for (order = 0, tmp = size >> 1; tmp; tmp >>= 1,  order++)
+		;
 
-	if ( size & ~(1 << order) )
+	if (size & (size - 1))
 		++order;
 
 	return order;
@@ -98,6 +99,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_map_t *map;
+	drm_map_t __user *argp = (void __user *)arg;
 	drm_map_list_t *list;
 
 	if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */
@@ -106,7 +108,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp,
 	if ( !map )
 		return -ENOMEM;
 
-	if ( copy_from_user( map, (drm_map_t *)arg, sizeof(*map) ) ) {
+	if ( copy_from_user( map, argp, sizeof(*map) ) ) {
 		DRM(free)( map, sizeof(*map), DRM_MEM_MAPS );
 		return -EFAULT;
 	}
@@ -207,10 +209,10 @@ int DRM(addmap)( struct inode *inode, struct file *filp,
 	list_add(&list->head, &dev->maplist->head);
  	up(&dev->struct_sem);
 
-	if ( copy_to_user( (drm_map_t *)arg, map, sizeof(*map) ) )
+	if ( copy_to_user( argp, map, sizeof(*map) ) )
 		return -EFAULT;
 	if ( map->type != _DRM_SHM ) {
-		if ( copy_to_user( &((drm_map_t *)arg)->handle,
+		if ( copy_to_user( &argp->handle,
 				   &map->offset,
 				   sizeof(map->offset) ) )
 			return -EFAULT;
@@ -247,7 +249,7 @@ int DRM(rmmap)(struct inode *inode, struct file *filp,
 	drm_map_t request;
 	int found_maps = 0;
 
-	if (copy_from_user(&request, (drm_map_t *)arg,
+	if (copy_from_user(&request, (drm_map_t __user *)arg,
 			   sizeof(request))) {
 		return -EFAULT;
 	}
@@ -389,10 +391,11 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp,
 	int byte_count;
 	int i;
 	drm_buf_t **temp_buflist;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 
 	if ( !dma ) return -EINVAL;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
+	if ( copy_from_user( &request, argp,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -529,7 +532,7 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp,
 	request.count = entry->buf_count;
 	request.size = size;
 
-	if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	dma->flags = _DRM_DMA_USE_AGP;
@@ -562,10 +565,11 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp,
 	int page_count;
 	unsigned long *temp_pagelist;
 	drm_buf_t **temp_buflist;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 
 	if ( !dma ) return -EINVAL;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
+	if ( copy_from_user( &request, argp,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -767,7 +771,7 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp,
 	request.count = entry->buf_count;
 	request.size = size;
 
-	if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	atomic_dec( &dev->buf_alloc );
@@ -783,6 +787,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 	drm_buf_desc_t request;
 	drm_buf_entry_t *entry;
 	drm_buf_t *buf;
@@ -800,7 +805,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 
 	if ( !dma ) return -EINVAL;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
+	if ( copy_from_user( &request, argp,
                              sizeof(request) ) )
 		return -EFAULT;
 
@@ -938,7 +943,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
 	request.count = entry->buf_count;
 	request.size = size;
 
-	if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	dma->flags = _DRM_DMA_USE_SG;
@@ -967,7 +972,7 @@ int DRM(addbufs)( struct inode *inode, struct file *filp,
 {
 	drm_buf_desc_t request;
 
-	if ( copy_from_user( &request, (drm_buf_desc_t *)arg,
+	if ( copy_from_user( &request, (drm_buf_desc_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -1013,6 +1018,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_device_dma_t *dma = dev->dma;
 	drm_buf_info_t request;
+	drm_buf_info_t __user *argp = (void __user *)arg;
 	int i;
 	int count;
 
@@ -1026,9 +1032,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	++dev->buf_use;		/* Can't allocate more after this call */
 	spin_unlock( &dev->count_lock );
 
-	if ( copy_from_user( &request,
-			     (drm_buf_info_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) {
@@ -1040,7 +1044,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	if ( request.count >= count ) {
 		for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) {
 			if ( dma->bufs[i].buf_count ) {
-				drm_buf_desc_t *to = &request.list[count];
+				drm_buf_desc_t __user *to = &request.list[count];
 				drm_buf_entry_t *from = &dma->bufs[i];
 				drm_freelist_t *list = &dma->bufs[i].freelist;
 				if ( copy_to_user( &to->count,
@@ -1069,9 +1073,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp,
 	}
 	request.count = count;
 
-	if ( copy_to_user( (drm_buf_info_t *)arg,
-			   &request,
-			   sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	return 0;
@@ -1104,7 +1106,7 @@ int DRM(markbufs)( struct inode *inode, struct file *filp,
 	if ( !dma ) return -EINVAL;
 
 	if ( copy_from_user( &request,
-			     (drm_buf_desc_t *)arg,
+			     (drm_buf_desc_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -1151,7 +1153,7 @@ int DRM(freebufs)( struct inode *inode, struct file *filp,
 	if ( !dma ) return -EINVAL;
 
 	if ( copy_from_user( &request,
-			     (drm_buf_free_t *)arg,
+			     (drm_buf_free_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
@@ -1197,6 +1199,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_map_t __user *argp = (void __user *)arg;
 	int retcode = 0;
 	const int zero = 0;
 	unsigned long virtual;
@@ -1214,8 +1217,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 	dev->buf_use++;		/* Can't allocate more after this call */
 	spin_unlock( &dev->count_lock );
 
-	if ( copy_from_user( &request, (drm_buf_map_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	if ( request.count >= dma->buf_count ) {
@@ -1262,7 +1264,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 			retcode = (signed long)virtual;
 			goto done;
 		}
-		request.virtual = (void *)virtual;
+		request.virtual = (void __user *)virtual;
 
 		for ( i = 0 ; i < dma->buf_count ; i++ ) {
 			if ( copy_to_user( &request.list[i].idx,
@@ -1296,7 +1298,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp,
 	request.count = dma->buf_count;
 	DRM_DEBUG( "%d buffers, retcode = %d\n", request.count, retcode );
 
-	if ( copy_to_user( (drm_buf_map_t *)arg, &request, sizeof(request) ) )
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
 		return -EFAULT;
 
 	return retcode;
diff --git a/linux/drm_context.h b/linux/drm_context.h
index 474b5ba0..8795198a 100644
--- a/linux/drm_context.h
+++ b/linux/drm_context.h
@@ -215,12 +215,11 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
 
-	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
-			   sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 
 	down(&dev->struct_sem);
@@ -233,7 +232,7 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp,
 	up(&dev->struct_sem);
 
 	request.handle = map->handle;
-	if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request)))
+	if (copy_to_user(argp, &request, sizeof(request)))
 		return -EFAULT;
 	return 0;
 }
@@ -261,7 +260,7 @@ int DRM(setsareactx)(struct inode *inode, struct file *filp,
 	struct list_head *list;
 
 	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
+			   (drm_ctx_priv_map_t __user *)arg,
 			   sizeof(request)))
 		return -EFAULT;
 
@@ -364,10 +363,11 @@ int DRM(resctx)( struct inode *inode, struct file *filp,
 		 unsigned int cmd, unsigned long arg )
 {
 	drm_ctx_res_t res;
+	drm_ctx_t __user *argp = (void __user *)arg;
 	drm_ctx_t ctx;
 	int i;
 
-	if ( copy_from_user( &res, (drm_ctx_res_t *)arg, sizeof(res) ) )
+	if ( copy_from_user( &res, argp, sizeof(res) ) )
 		return -EFAULT;
 
 	if ( res.count >= DRM_RESERVED_CONTEXTS ) {
@@ -381,7 +381,7 @@ int DRM(resctx)( struct inode *inode, struct file *filp,
 	}
 	res.count = DRM_RESERVED_CONTEXTS;
 
-	if ( copy_to_user( (drm_ctx_res_t *)arg, &res, sizeof(res) ) )
+	if ( copy_to_user( argp, &res, sizeof(res) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -403,9 +403,10 @@ int DRM(addctx)( struct inode *inode, struct file *filp,
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_ctx_list_t * ctx_entry;
+	drm_ctx_t __user *argp = (void __user *)arg;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, argp, sizeof(ctx) ) )
 		return -EFAULT;
 
 	ctx.handle = DRM(ctxbitmap_next)( dev );
@@ -438,7 +439,7 @@ int DRM(addctx)( struct inode *inode, struct file *filp,
 	++dev->ctx_count;
 	up( &dev->ctxlist_sem );
 
-	if ( copy_to_user( (drm_ctx_t *)arg, &ctx, sizeof(ctx) ) )
+	if ( copy_to_user( argp, &ctx, sizeof(ctx) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -462,15 +463,16 @@ int DRM(modctx)( struct inode *inode, struct file *filp,
 int DRM(getctx)( struct inode *inode, struct file *filp,
 		 unsigned int cmd, unsigned long arg )
 {
+	drm_ctx_t __user *argp = (void __user *)arg;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t*)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, argp, sizeof(ctx) ) )
 		return -EFAULT;
 
 	/* This is 0, because we don't handle any context flags */
 	ctx.flags = 0;
 
-	if ( copy_to_user( (drm_ctx_t*)arg, &ctx, sizeof(ctx) ) )
+	if ( copy_to_user( argp, &ctx, sizeof(ctx) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -493,7 +495,7 @@ int DRM(switchctx)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) )
 		return -EFAULT;
 
 	DRM_DEBUG( "%d\n", ctx.handle );
@@ -518,7 +520,7 @@ int DRM(newctx)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) )
 		return -EFAULT;
 
 	DRM_DEBUG( "%d\n", ctx.handle );
@@ -545,7 +547,7 @@ int DRM(rmctx)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_ctx_t ctx;
 
-	if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) )
+	if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) )
 		return -EFAULT;
 
 	DRM_DEBUG( "%d\n", ctx.handle );
diff --git a/linux/drm_dma.h b/linux/drm_dma.h
index 14ae5545..04467342 100644
--- a/linux/drm_dma.h
+++ b/linux/drm_dma.h
@@ -215,7 +215,7 @@ int DRM(control)( struct inode *inode, struct file *filp,
 {
 	drm_control_t ctl;
 
-	if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) )
+	if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) )
 		return -EFAULT;
 
 	switch ( ctl.func ) {
diff --git a/linux/drm_drawable.h b/linux/drm_drawable.h
index 892ae4e0..59c13ef8 100644
--- a/linux/drm_drawable.h
+++ b/linux/drm_drawable.h
@@ -44,7 +44,7 @@ int DRM(adddraw)(struct inode *inode, struct file *filp,
 
 	draw.handle = 0;	/* NOOP */
 	DRM_DEBUG("%d\n", draw.handle);
-	if (copy_to_user((drm_draw_t *)arg, &draw, sizeof(draw)))
+	if (copy_to_user((drm_draw_t __user *)arg, &draw, sizeof(draw)))
 		return -EFAULT;
 	return 0;
 }
diff --git a/linux/drm_drv.h b/linux/drm_drv.h
index 42831be0..706d762f 100644
--- a/linux/drm_drv.h
+++ b/linux/drm_drv.h
@@ -817,12 +817,11 @@ module_exit( drm_exit );
 int DRM(version)( struct inode *inode, struct file *filp,
 		  unsigned int cmd, unsigned long arg )
 {
+	drm_version_t __user *argp = (void __user *)arg;
 	drm_version_t version;
 	int len;
 
-	if ( copy_from_user( &version,
-			     (drm_version_t *)arg,
-			     sizeof(version) ) )
+	if ( copy_from_user( &version, argp, sizeof(version) ) )
 		return -EFAULT;
 
 #define DRM_COPY( name, value )						\
@@ -842,9 +841,7 @@ int DRM(version)( struct inode *inode, struct file *filp,
 	DRM_COPY( version.date, DRIVER_DATE );
 	DRM_COPY( version.desc, DRIVER_DESC );
 
-	if ( copy_to_user( (drm_version_t *)arg,
-			   &version,
-			   sizeof(version) ) )
+	if ( copy_to_user( argp, &version, sizeof(version) ) )
 		return -EFAULT;
 	return 0;
 }
@@ -1124,7 +1121,7 @@ int DRM(lock)( struct inode *inode, struct file *filp,
 
 	++priv->lock_count;
 
-        if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) )
+        if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) )
 		return -EFAULT;
 
         if ( lock.context == DRM_KERNEL_CONTEXT ) {
@@ -1237,7 +1234,7 @@ int DRM(unlock)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_lock_t lock;
 
-	if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) )
+	if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) )
 		return -EFAULT;
 
 	if ( lock.context == DRM_KERNEL_CONTEXT ) {
diff --git a/linux/drm_fops.h b/linux/drm_fops.h
index 152cb4d7..869736a4 100644
--- a/linux/drm_fops.h
+++ b/linux/drm_fops.h
@@ -142,7 +142,7 @@ unsigned int DRM(poll)(struct file *filp, struct poll_table_struct *wait)
 
 #if !__HAVE_DRIVER_FOPS_READ
 /** No-op. */
-ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off)
+ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off)
 {
 	return 0;
 }
diff --git a/linux/drm_ioctl.h b/linux/drm_ioctl.h
index 5fa7694c..379a4f05 100644
--- a/linux/drm_ioctl.h
+++ b/linux/drm_ioctl.h
@@ -54,16 +54,17 @@ int DRM(getunique)(struct inode *inode, struct file *filp,
 {
 	drm_file_t	 *priv	 = filp->private_data;
 	drm_device_t	 *dev	 = priv->dev;
+	drm_unique_t     __user *argp = (void __user *)arg;
 	drm_unique_t	 u;
 
-	if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u)))
+	if (copy_from_user(&u, argp, sizeof(u)))
 		return -EFAULT;
 	if (u.unique_len >= dev->unique_len) {
 		if (copy_to_user(u.unique, dev->unique, dev->unique_len))
 			return -EFAULT;
 	}
 	u.unique_len = dev->unique_len;
-	if (copy_to_user((drm_unique_t *)arg, &u, sizeof(u)))
+	if (copy_to_user(argp, &u, sizeof(u)))
 		return -EFAULT;
 	return 0;
 }
@@ -92,7 +93,8 @@ int DRM(setunique)(struct inode *inode, struct file *filp,
 
 	if (dev->unique_len || dev->unique) return -EBUSY;
 
-	if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u))) return -EFAULT;
+	if (copy_from_user(&u, (drm_unique_t __user *)arg, sizeof(u))) 
+		return -EFAULT;
 
 	if (!u.unique_len || u.unique_len > 1024) return -EINVAL;
 
@@ -172,13 +174,14 @@ int DRM(getmap)( struct inode *inode, struct file *filp,
 {
 	drm_file_t   *priv = filp->private_data;
 	drm_device_t *dev  = priv->dev;
+	drm_map_t    __user *argp = (void __user *)arg;
 	drm_map_t    map;
 	drm_map_list_t *r_list = NULL;
 	struct list_head *list;
 	int          idx;
 	int	     i;
 
-	if (copy_from_user(&map, (drm_map_t *)arg, sizeof(map)))
+	if (copy_from_user(&map, argp, sizeof(map)))
 		return -EFAULT;
 	idx = map.offset;
 
@@ -209,7 +212,7 @@ int DRM(getmap)( struct inode *inode, struct file *filp,
 	map.mtrr   = r_list->map->mtrr;
 	up(&dev->struct_sem);
 
-	if (copy_to_user((drm_map_t *)arg, &map, sizeof(map))) return -EFAULT;
+	if (copy_to_user(argp, &map, sizeof(map))) return -EFAULT;
 	return 0;
 }
 
@@ -231,12 +234,13 @@ int DRM(getclient)( struct inode *inode, struct file *filp,
 {
 	drm_file_t   *priv = filp->private_data;
 	drm_device_t *dev  = priv->dev;
+	drm_client_t __user *argp = (void __user *)arg;	
 	drm_client_t client;
 	drm_file_t   *pt;
 	int          idx;
 	int          i;
 
-	if (copy_from_user(&client, (drm_client_t *)arg, sizeof(client)))
+	if (copy_from_user(&client, argp, sizeof(client)))
 		return -EFAULT;
 	idx = client.idx;
 	down(&dev->struct_sem);
@@ -254,7 +258,7 @@ int DRM(getclient)( struct inode *inode, struct file *filp,
 	client.iocs  = pt->ioctl_count;
 	up(&dev->struct_sem);
 
-	if (copy_to_user((drm_client_t *)arg, &client, sizeof(client)))
+	if (copy_to_user(argp, &client, sizeof(client)))
 		return -EFAULT;
 	return 0;
 }
@@ -295,7 +299,7 @@ int DRM(getstats)( struct inode *inode, struct file *filp,
 
 	up(&dev->struct_sem);
 
-	if (copy_to_user((drm_stats_t *)arg, &stats, sizeof(stats)))
+	if (copy_to_user((drm_stats_t __user *)arg, &stats, sizeof(stats)))
 		return -EFAULT;
 	return 0;
 }
@@ -309,15 +313,16 @@ int DRM(setversion)(DRM_IOCTL_ARGS)
 	drm_set_version_t sv;
 	drm_set_version_t retv;
 	int if_version;
+	drm_set_version_t __user *argp = (void __user *)data;
 
-	DRM_COPY_FROM_USER_IOCTL(sv, (drm_set_version_t *)data, sizeof(sv));
+	DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));
 
 	retv.drm_di_major = DRM_IF_MAJOR;
 	retv.drm_di_minor = DRM_IF_MINOR;
 	retv.drm_dd_major = DRIVER_MAJOR;
 	retv.drm_dd_minor = DRIVER_MINOR;
 
-	DRM_COPY_TO_USER_IOCTL((drm_set_version_t *)data, retv, sizeof(sv));
+	DRM_COPY_TO_USER_IOCTL(argp, retv, sizeof(sv));
 
 	if (sv.drm_di_major != -1) {
 		if (sv.drm_di_major != DRM_IF_MAJOR ||
diff --git a/linux/drm_irq.h b/linux/drm_irq.h
index f53f142a..035eb70f 100644
--- a/linux/drm_irq.h
+++ b/linux/drm_irq.h
@@ -66,9 +66,10 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp,
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
+	drm_irq_busid_t __user *argp = (void __user *)arg;
 	drm_irq_busid_t p;
 
-	if (copy_from_user(&p, (drm_irq_busid_t *)arg, sizeof(p)))
+	if (copy_from_user(&p, argp, sizeof(p)))
 		return -EFAULT;
 
 	if ((p.busnum >> 8) != dev->pci_domain ||
@@ -81,7 +82,7 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp,
 
 	DRM_DEBUG("%d:%d:%d => IRQ %d\n",
 		  p.busnum, p.devnum, p.funcnum, p.irq);
-	if (copy_to_user((drm_irq_busid_t *)arg, &p, sizeof(p)))
+	if (copy_to_user(argp, &p, sizeof(p)))
 		return -EFAULT;
 	return 0;
 }
@@ -214,7 +215,7 @@ int DRM(control)( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_control_t ctl;
 
-	if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) )
+	if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) )
 		return -EFAULT;
 
 	switch ( ctl.func ) {
@@ -255,6 +256,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS )
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
+	drm_wait_vblank_t __user *argp = (void __user *)data;
 	drm_wait_vblank_t vblwait;
 	struct timeval now;
 	int ret = 0;
@@ -263,8 +265,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS )
 	if (!dev->irq)
 		return -EINVAL;
 
-	DRM_COPY_FROM_USER_IOCTL( vblwait, (drm_wait_vblank_t *)data,
-				  sizeof(vblwait) );
+	DRM_COPY_FROM_USER_IOCTL( vblwait, argp, sizeof(vblwait) );
 
 	switch ( vblwait.request.type & ~_DRM_VBLANK_FLAGS_MASK ) {
 	case _DRM_VBLANK_RELATIVE:
@@ -333,8 +334,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS )
 	}
 
 done:
-	DRM_COPY_TO_USER_IOCTL( (drm_wait_vblank_t *)data, vblwait,
-				sizeof(vblwait) );
+	DRM_COPY_TO_USER_IOCTL( argp, vblwait, sizeof(vblwait) );
 
 	return ret;
 }
diff --git a/linux/drm_scatter.h b/linux/drm_scatter.h
index 45a30fc3..4aaf89d4 100644
--- a/linux/drm_scatter.h
+++ b/linux/drm_scatter.h
@@ -67,6 +67,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp,
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
+	drm_scatter_gather_t __user *argp = (void __user *)arg;
 	drm_scatter_gather_t request;
 	drm_sg_mem_t *entry;
 	unsigned long pages, i, j;
@@ -76,9 +77,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp,
 	if ( dev->sg )
 		return -EINVAL;
 
-	if ( copy_from_user( &request,
-			     (drm_scatter_gather_t *)arg,
-			     sizeof(request) ) )
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
 		return -EFAULT;
 
 	entry = DRM(alloc)( sizeof(*entry), DRM_MEM_SGLISTS );
@@ -146,9 +145,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp,
 
 	request.handle = entry->handle;
 
-	if ( copy_to_user( (drm_scatter_gather_t *)arg,
-			   &request,
-			   sizeof(request) ) ) {
+	if ( copy_to_user( argp, &request, sizeof(request) ) ) {
 		DRM(sg_cleanup)( entry );
 		return -EFAULT;
 	}
@@ -211,7 +208,7 @@ int DRM(sg_free)( struct inode *inode, struct file *filp,
 	drm_sg_mem_t *entry;
 
 	if ( copy_from_user( &request,
-			     (drm_scatter_gather_t *)arg,
+			     (drm_scatter_gather_t __user *)arg,
 			     sizeof(request) ) )
 		return -EFAULT;
 
diff --git a/linux/gamma_context.h b/linux/gamma_context.h
index df319c03..1c854066 100644
--- a/linux/gamma_context.h
+++ b/linux/gamma_context.h
@@ -42,7 +42,7 @@
    the circular buffer), is based on Alessandro Rubini's LINUX DEVICE
    DRIVERS (Cambridge: O'Reilly, 1998), pages 111-113. */
 
-ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off)
+ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off)
 {
 	drm_file_t    *priv   = filp->private_data;
 	drm_device_t  *dev    = priv->dev;
@@ -295,12 +295,13 @@ static int DRM(alloc_queue)(drm_device_t *dev)
 int DRM(resctx)(struct inode *inode, struct file *filp,
 		unsigned int cmd, unsigned long arg)
 {
+	drm_ctx_res_t __user *argp = (void __user *)arg;
 	drm_ctx_res_t	res;
 	drm_ctx_t	ctx;
 	int		i;
 
 	DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS);
-	if (copy_from_user(&res, (drm_ctx_res_t *)arg, sizeof(res)))
+	if (copy_from_user(&res, argp, sizeof(res)))
 		return -EFAULT;
 	if (res.count >= DRM_RESERVED_CONTEXTS) {
 		memset(&ctx, 0, sizeof(ctx));
@@ -313,7 +314,7 @@ int DRM(resctx)(struct inode *inode, struct file *filp,
 		}
 	}
 	res.count = DRM_RESERVED_CONTEXTS;
-	if (copy_to_user((drm_ctx_res_t *)arg, &res, sizeof(res)))
+	if (copy_to_user(argp, &res, sizeof(res)))
 		return -EFAULT;
 	return 0;
 }
@@ -324,8 +325,9 @@ int DRM(addctx)(struct inode *inode, struct file *filp,
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
+	drm_ctx_t       __user *argp = (void __user *)arg;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, argp, sizeof(ctx)))
 		return -EFAULT;
 	if ((ctx.handle = DRM(alloc_queue)(dev)) == DRM_KERNEL_CONTEXT) {
 				/* Init kernel's context and get a new one. */
@@ -334,7 +336,7 @@ int DRM(addctx)(struct inode *inode, struct file *filp,
 	}
 	DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx);
 	DRM_DEBUG("%d\n", ctx.handle);
-	if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx)))
+	if (copy_to_user(argp, &ctx, sizeof(ctx)))
 		return -EFAULT;
 	return 0;
 }
@@ -347,7 +349,7 @@ int DRM(modctx)(struct inode *inode, struct file *filp,
 	drm_ctx_t	ctx;
 	drm_queue_t	*q;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 
 	DRM_DEBUG("%d\n", ctx.handle);
@@ -378,10 +380,11 @@ int DRM(getctx)(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t       __user *argp = (void __user *)arg;
 	drm_ctx_t	ctx;
 	drm_queue_t	*q;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, argp, sizeof(ctx)))
 		return -EFAULT;
 
 	DRM_DEBUG("%d\n", ctx.handle);
@@ -399,7 +402,7 @@ int DRM(getctx)(struct inode *inode, struct file *filp,
 	ctx.flags = q->flags;
 	atomic_dec(&q->use_count);
 
-	if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx)))
+	if (copy_to_user(argp, &ctx, sizeof(ctx)))
 		return -EFAULT;
 
 	return 0;
@@ -412,7 +415,7 @@ int DRM(switchctx)(struct inode *inode, struct file *filp,
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 	return DRM(context_switch)(dev, dev->last_context, ctx.handle);
@@ -425,7 +428,7 @@ int DRM(newctx)(struct inode *inode, struct file *filp,
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 	DRM(context_switch_complete)(dev, ctx.handle);
@@ -442,7 +445,7 @@ int DRM(rmctx)(struct inode *inode, struct file *filp,
 	drm_queue_t	*q;
 	drm_buf_t	*buf;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 
diff --git a/linux/gamma_dma.c b/linux/gamma_dma.c
index 155275ce..ffa5ce1d 100644
--- a/linux/gamma_dma.c
+++ b/linux/gamma_dma.c
@@ -148,6 +148,7 @@ irqreturn_t gamma_irq_handler( DRM_IRQ_ARGS )
 		queue_task(&dev->tq, &tq_immediate);
 		mark_bh(IMMEDIATE_BH);
 #else
+		/* Dispatch new buffer */
 		schedule_work(&dev->work);
 #endif
 	}
@@ -571,9 +572,10 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
 	drm_device_t	  *dev	    = priv->dev;
 	drm_device_dma_t  *dma	    = dev->dma;
 	int		  retcode   = 0;
+	drm_dma_t         __user *argp = (void __user *)arg;
 	drm_dma_t	  d;
 
-	if (copy_from_user(&d, (drm_dma_t *)arg, sizeof(d)))
+	if (copy_from_user(&d, argp, sizeof(d)))
 		return -EFAULT;
 
 	if (d.send_count < 0 || d.send_count > dma->buf_count) {
@@ -603,7 +605,7 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	DRM_DEBUG("%d returning, granted = %d\n",
 		  current->pid, d.granted_count);
-	if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d)))
+	if (copy_to_user(argp, &d, sizeof(d)))
 		return -EFAULT;
 
 	return retcode;
@@ -726,7 +728,7 @@ int gamma_dma_init( struct inode *inode, struct file *filp,
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	if ( copy_from_user( &init, (drm_gamma_init_t *)arg, sizeof(init) ) )
+	if ( copy_from_user( &init, (drm_gamma_init_t __user *)arg, sizeof(init) ) )
 		return -EFAULT;
 
 	switch ( init.func ) {
@@ -795,7 +797,7 @@ int gamma_dma_copy( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_gamma_copy_t copy;
 
-	if ( copy_from_user( &copy, (drm_gamma_copy_t *)arg, sizeof(copy) ) )
+	if ( copy_from_user( &copy, (drm_gamma_copy_t __user *)arg, sizeof(copy) ) )
 		return -EFAULT;
 
 	return gamma_do_copy_dma( dev, &copy );
@@ -810,12 +812,11 @@ int gamma_getsareactx(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
 
-	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
-			   sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 
 	down(&dev->struct_sem);
@@ -828,7 +829,7 @@ int gamma_getsareactx(struct inode *inode, struct file *filp,
 	up(&dev->struct_sem);
 
 	request.handle = map->handle;
-	if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request)))
+	if (copy_to_user(argp, &request, sizeof(request)))
 		return -EFAULT;
 	return 0;
 }
@@ -844,7 +845,7 @@ int gamma_setsareactx(struct inode *inode, struct file *filp,
 	struct list_head *list;
 
 	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
+			   (drm_ctx_priv_map_t __user *)arg,
 			   sizeof(request)))
 		return -EFAULT;
 
diff --git a/linux/gamma_lock.h b/linux/gamma_lock.h
index 1ecbf8f9..ddec67e4 100644
--- a/linux/gamma_lock.h
+++ b/linux/gamma_lock.h
@@ -132,7 +132,7 @@ int DRM(finish)(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	DRM_DEBUG("\n");
 
-	if (copy_from_user(&lock, (drm_lock_t *)arg, sizeof(lock)))
+	if (copy_from_user(&lock, (drm_lock_t __user *)arg, sizeof(lock)))
 		return -EFAULT;
 	ret = DRM(flush_block_and_flush)(dev, lock.context, lock.flags);
 	DRM(flush_unblock)(dev, lock.context, lock.flags);