sync up with current 2.6 kernel bk tree - mostly __user annotations

18 files changed, 131 insertions, 124 deletions

diff --git a/shared-core/drm.h b/shared-core/drm.h
index 84e97fa2..ce51dfc1 100644
--- a/shared-core/drm.h
+++ b/shared-core/drm.h
@@ -174,11 +174,11 @@ typedef struct drm_version {
 	int    version_minor;	  /**< Minor version */
 	int    version_patchlevel;/**< Patch level */
 	DRM_SIZE_T name_len;	  /**< Length of name buffer */
-	char   *name;		  /**< Name of driver */
+	char   __user *name;		  /**< Name of driver */
 	DRM_SIZE_T date_len;	  /**< Length of date buffer */
-	char   *date;		  /**< User-space buffer to hold date */
+	char   __user *date;		  /**< User-space buffer to hold date */
 	DRM_SIZE_T desc_len;	  /**< Length of desc buffer */
-	char   *desc;		  /**< User-space buffer to hold desc */
+	char   __user *desc;		  /**< User-space buffer to hold desc */
 } drm_version_t;
 
 
@@ -189,14 +189,14 @@ typedef struct drm_version {
  */
 typedef struct drm_unique {
 	DRM_SIZE_T unique_len;	  /**< Length of unique */
-	char   *unique;		  /**< Unique name for driver instantiation */
+	char   __user *unique;		  /**< Unique name for driver instantiation */
 } drm_unique_t;
 
 #undef DRM_SIZE_T
 
 typedef struct drm_list {
 	int		 count;	  /**< Length of user-space structures */
-	drm_version_t	 *version;
+	drm_version_t	 __user *version;
 } drm_list_t;
 
 
@@ -402,7 +402,7 @@ typedef struct drm_buf_desc {
  */
 typedef struct drm_buf_info {
 	int	       count;	  /**< Number of buffers described in list */
-	drm_buf_desc_t *list;	  /**< List of buffer descriptions */
+	drm_buf_desc_t __user *list;	  /**< List of buffer descriptions */
 } drm_buf_info_t;
 
 
@@ -411,7 +411,7 @@ typedef struct drm_buf_info {
  */
 typedef struct drm_buf_free {
 	int	       count;
-	int	       *list;
+	int	       __user *list;
 } drm_buf_free_t;
 
 
@@ -424,7 +424,7 @@ typedef struct drm_buf_pub {
 	int		  idx;	       /**< Index into the master buffer list */
 	int		  total;       /**< Buffer size */
 	int		  used;	       /**< Amount of buffer in use (for DMA) */
-	void		  *address;    /**< Address of buffer */
+	void	  __user *address;     /**< Address of buffer */
 } drm_buf_pub_t;
 
 
@@ -433,8 +433,8 @@ typedef struct drm_buf_pub {
  */
 typedef struct drm_buf_map {
 	int	      count;	/**< Length of the buffer list */
-	void	      *virtual;	/**< Mmap'd area in user-virtual */
-	drm_buf_pub_t *list;	/**< Buffer information */
+	void	      __user *virtual;	/**< Mmap'd area in user-virtual */
+	drm_buf_pub_t __user *list;	/**< Buffer information */
 } drm_buf_map_t;
 
 
@@ -448,13 +448,13 @@ typedef struct drm_buf_map {
 typedef struct drm_dma {
 	int		context;	  /**< Context handle */
 	int		send_count;	  /**< Number of buffers to send */
-	int		*send_indices;	  /**< List of handles to buffers */
-	int		*send_sizes;	  /**< Lengths of data to send */
+	int	__user *send_indices;	  /**< List of handles to buffers */
+	int	__user *send_sizes;	  /**< Lengths of data to send */
 	drm_dma_flags_t flags;		  /**< Flags */
 	int		request_count;	  /**< Number of buffers requested */
 	int		request_size;	  /**< Desired size for buffers */
-	int		*request_indices; /**< Buffer information */
-	int		*request_sizes;
+	int	__user *request_indices; /**< Buffer information */
+	int	__user *request_sizes;
 	int		granted_count;	  /**< Number of buffers granted */
 } drm_dma_t;
 
@@ -481,7 +481,7 @@ typedef struct drm_ctx {
  */
 typedef struct drm_ctx_res {
 	int		count;
-	drm_ctx_t	*contexts;
+	drm_ctx_t	__user *contexts;
 } drm_ctx_res_t;
 
 
diff --git a/shared-core/i915_dma.c b/shared-core/i915_dma.c
index 6d85e050..d1a441e7 100644
--- a/shared-core/i915_dma.c
+++ b/shared-core/i915_dma.c
@@ -15,7 +15,7 @@
 #include "i915_drv.h"
 
 
-static void i915_print_status_page(drm_device_t *dev)
+static inline void i915_print_status_page(drm_device_t *dev)
 {
       	drm_i915_private_t *dev_priv = dev->dev_private;
 	u32 *temp = dev_priv->hw_status_page;
@@ -246,7 +246,7 @@ int i915_dma_init( DRM_IOCTL_ARGS )
    	drm_i915_init_t init;
    	int retcode = 0;
 	
-  	DRM_COPY_FROM_USER_IOCTL( init, (drm_i915_init_t *)data, sizeof(init));
+  	DRM_COPY_FROM_USER_IOCTL( init, (drm_i915_init_t __user *)data, sizeof(init));
 	
    	switch(init.func) {
 	 	case I915_INIT_DMA:
@@ -351,7 +351,7 @@ static int validate_cmd( int cmd )
 	
 
 static int i915_emit_cmds( drm_device_t *dev,
-			   int *buffer,
+			   int __user *buffer,
 			   int dwords )
 {
    	drm_i915_private_t *dev_priv = dev->dev_private;
@@ -386,7 +386,7 @@ static int i915_emit_cmds( drm_device_t *dev,
 }
 
 static int i915_emit_box( drm_device_t *dev,
-			  drm_clip_rect_t *boxes,
+			  drm_clip_rect_t __user *boxes,
 			  int i,
 			  int DR1,
 			  int DR4)
@@ -425,10 +425,8 @@ static int i915_emit_box( drm_device_t *dev,
 static int i915_dispatch_cmdbuffer(drm_device_t *dev, 
 				   drm_i915_cmdbuffer_t *cmd )
 {
-   	drm_i915_private_t *dev_priv = dev->dev_private;
    	int nbox = cmd->num_cliprects;
 	int i = 0, count, ret;
-   	RING_LOCALS;
 
 	if (cmd->sz & 0x3) {
 		DRM_ERROR("alignment");
@@ -447,7 +445,7 @@ static int i915_dispatch_cmdbuffer(drm_device_t *dev,
 				return ret;
 		}
 
-		ret = i915_emit_cmds( dev, (int *)cmd->buf, cmd->sz / 4 );
+		ret = i915_emit_cmds( dev, (int __user *)cmd->buf, cmd->sz / 4 );
 		if (ret) 
 			return ret;
 	}
@@ -462,7 +460,7 @@ static int i915_dispatch_batchbuffer(drm_device_t *dev,
 				    drm_i915_batchbuffer_t *batch )
 {
    	drm_i915_private_t *dev_priv = dev->dev_private;
-   	drm_clip_rect_t box, *boxes = batch->cliprects;
+   	drm_clip_rect_t *boxes = batch->cliprects;
    	int nbox = batch->num_cliprects;
 	int i = 0, count;
    	RING_LOCALS;
@@ -602,7 +600,7 @@ int i915_batchbuffer( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( batch, (drm_i915_batchbuffer_t *)data, 
+	DRM_COPY_FROM_USER_IOCTL( batch, (drm_i915_batchbuffer_t __user *)data, 
 				  sizeof(batch) );
 
 	DRM_DEBUG("i915 batchbuffer, start %x used %d cliprects %d\n",
@@ -635,7 +633,7 @@ int i915_cmdbuffer( DRM_IOCTL_ARGS )
 	drm_i915_cmdbuffer_t cmdbuf;
 	int ret;
 
-	DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_i915_cmdbuffer_t *)data, 
+	DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_i915_cmdbuffer_t __user *)data, 
 				  sizeof(cmdbuf) );
 
 	DRM_DEBUG("i915 cmdbuffer, buf %p sz %d cliprects %d\n",
@@ -705,7 +703,7 @@ int i915_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL(param, (drm_i915_getparam_t *)data, 
+	DRM_COPY_FROM_USER_IOCTL(param, (drm_i915_getparam_t __user *)data, 
 				 sizeof(param));
 
 	switch( param.param ) {
@@ -740,7 +738,7 @@ int i915_setparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_i915_setparam_t *)data, 
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_i915_setparam_t __user *)data, 
 				  sizeof(param) );
 
 	switch( param.param ) {
diff --git a/shared-core/i915_drm.h b/shared-core/i915_drm.h
index 707e553c..7a69e83f 100644
--- a/shared-core/i915_drm.h
+++ b/shared-core/i915_drm.h
@@ -87,26 +87,26 @@ typedef struct _drm_i915_batchbuffer {
 	int DR1;		/* hw flags for GFX_OP_DRAWRECT_INFO */
         int DR4;		/* window origin for GFX_OP_DRAWRECT_INFO*/
 	int num_cliprects;	/* mulitpass with multiple cliprects? */
-        drm_clip_rect_t *cliprects; /* pointer to userspace cliprects */
+        drm_clip_rect_t __user *cliprects; /* pointer to userspace cliprects */
 } drm_i915_batchbuffer_t;
 
 /* As above, but pass a pointer to userspace buffer which can be
  * validated by the kernel prior to sending to hardware.
  */
 typedef struct _drm_i915_cmdbuffer {
-   	char *buf;	        /* pointer to userspace command buffer */
+   	char __user *buf;	/* pointer to userspace command buffer */
 	int sz;		        /* nr bytes in buf */
 	int DR1;		/* hw flags for GFX_OP_DRAWRECT_INFO */
         int DR4;		/* window origin for GFX_OP_DRAWRECT_INFO*/
 	int num_cliprects;	/* mulitpass with multiple cliprects? */
-        drm_clip_rect_t *cliprects; /* pointer to userspace cliprects */
+        drm_clip_rect_t __user *cliprects; /* pointer to userspace cliprects */
 } drm_i915_cmdbuffer_t;
 
 
 /* Userspace can request & wait on irq's:
  */
 typedef struct drm_i915_irq_emit {
-	int *irq_seq;
+	int __user *irq_seq;
 } drm_i915_irq_emit_t;
 
 typedef struct drm_i915_irq_wait {
@@ -121,7 +121,7 @@ typedef struct drm_i915_irq_wait {
 
 typedef struct drm_i915_getparam {
 	int param;
-	int *value;
+	int __user *value;
 } drm_i915_getparam_t;
 
 
@@ -144,7 +144,7 @@ typedef struct drm_i915_mem_alloc {
 	int region;
 	int alignment;
 	int size;
-	int *region_offset;	/* offset from start of fb or agp */
+	int __user *region_offset;	/* offset from start of fb or agp */
 } drm_i915_mem_alloc_t;
 
 typedef struct drm_i915_mem_free {
diff --git a/shared-core/i915_irq.c b/shared-core/i915_irq.c
index f9d5d4b7..e37da827 100644
--- a/shared-core/i915_irq.c
+++ b/shared-core/i915_irq.c
@@ -108,7 +108,7 @@ int i915_irq_emit( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( emit, (drm_i915_irq_emit_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( emit, (drm_i915_irq_emit_t __user *)data,
 				  sizeof(emit) );
 
 	result = i915_emit_irq( dev );
@@ -135,7 +135,7 @@ int i915_irq_wait( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_i915_irq_wait_t *)data, 
+	DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_i915_irq_wait_t __user *)data, 
 				  sizeof(irqwait) );
 
 	return i915_wait_irq( dev, irqwait.irq_seq );
diff --git a/shared-core/i915_mem.c b/shared-core/i915_mem.c
index 0e413d47..2a2379d0 100644
--- a/shared-core/i915_mem.c
+++ b/shared-core/i915_mem.c
@@ -268,7 +268,7 @@ int i915_mem_alloc( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( alloc, (drm_i915_mem_alloc_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( alloc, (drm_i915_mem_alloc_t __user *)data,
 				  sizeof(alloc) );
 
 	heap = get_heap( dev_priv, alloc.region );
@@ -312,7 +312,7 @@ int i915_mem_free( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( memfree, (drm_i915_mem_free_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( memfree, (drm_i915_mem_free_t __user *)data,
 				  sizeof(memfree) );
 
 	heap = get_heap( dev_priv, memfree.region );
@@ -343,7 +343,7 @@ int i915_mem_init_heap( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( initheap, (drm_i915_mem_init_heap_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( initheap, (drm_i915_mem_init_heap_t __user *)data,
 				  sizeof(initheap) );
 
 	heap = get_heap( dev_priv, initheap.region );
diff --git a/shared-core/mga_dma.c b/shared-core/mga_dma.c
index 5e5c407d..76fbf714 100644
--- a/shared-core/mga_dma.c
+++ b/shared-core/mga_dma.c
@@ -668,7 +668,7 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t *)data, sizeof(init) );
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case MGA_INIT_DMA:
@@ -693,7 +693,7 @@ int mga_dma_flush( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( lock, (drm_lock_t *)data, sizeof(lock) );
+	DRM_COPY_FROM_USER_IOCTL( lock, (drm_lock_t __user *)data, sizeof(lock) );
 
 	DRM_DEBUG( "%s%s%s\n",
 		   (lock.flags & _DRM_LOCK_FLUSH) ?	"flush, " : "",
@@ -764,12 +764,13 @@ int mga_dma_buffers( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_device_dma_t *dma = dev->dma;
 	drm_mga_private_t *dev_priv = (drm_mga_private_t *)dev->dev_private;
+	drm_dma_t __user *argp = (void __user *)data;
 	drm_dma_t d;
 	int ret = 0;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *)data, sizeof(d) );
+	DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) );
 
 	/* Please don't send us buffers.
 	 */
@@ -795,7 +796,7 @@ int mga_dma_buffers( DRM_IOCTL_ARGS )
 		ret = mga_dma_get_buffers( filp, dev, &d );
 	}
 
-	DRM_COPY_TO_USER_IOCTL( (drm_dma_t *)data, d, sizeof(d) );
+	DRM_COPY_TO_USER_IOCTL( argp, d, sizeof(d) );
 
 	return ret;
 }
diff --git a/shared-core/mga_drm.h b/shared-core/mga_drm.h
index 98988906..521d4451 100644
--- a/shared-core/mga_drm.h
+++ b/shared-core/mga_drm.h
@@ -343,7 +343,7 @@ typedef struct _drm_mga_blit {
 
 typedef struct drm_mga_getparam {
 	int param;
-	void *value;
+	void __user *value;
 } drm_mga_getparam_t;
 
 #endif
diff --git a/shared-core/mga_state.c b/shared-core/mga_state.c
index 256dd47d..43659825 100644
--- a/shared-core/mga_state.c
+++ b/shared-core/mga_state.c
@@ -889,7 +889,7 @@ int mga_dma_clear( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( clear, (drm_mga_clear_t *)data, sizeof(clear) );
+	DRM_COPY_FROM_USER_IOCTL( clear, (drm_mga_clear_t __user *)data, sizeof(clear) );
 
 	if ( sarea_priv->nbox > MGA_NR_SAREA_CLIPRECTS )
 		sarea_priv->nbox = MGA_NR_SAREA_CLIPRECTS;
@@ -939,7 +939,7 @@ int mga_dma_vertex( DRM_IOCTL_ARGS )
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
 	DRM_COPY_FROM_USER_IOCTL( vertex,
-			     (drm_mga_vertex_t *)data,
+			     (drm_mga_vertex_t __user *)data,
 			     sizeof(vertex) );
 
         if(vertex.idx < 0 || vertex.idx > dma->buf_count) return DRM_ERR(EINVAL);
@@ -978,7 +978,7 @@ int mga_dma_indices( DRM_IOCTL_ARGS )
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
 	DRM_COPY_FROM_USER_IOCTL( indices,
-			     (drm_mga_indices_t *)data,
+			     (drm_mga_indices_t __user *)data,
 			     sizeof(indices) );
 
         if(indices.idx < 0 || indices.idx > dma->buf_count) return DRM_ERR(EINVAL);
@@ -1017,7 +1017,7 @@ int mga_dma_iload( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( iload, (drm_mga_iload_t *)data, sizeof(iload) );
+	DRM_COPY_FROM_USER_IOCTL( iload, (drm_mga_iload_t __user *)data, sizeof(iload) );
 
 #if 0
 	if ( mga_do_wait_for_idle( dev_priv ) < 0 ) {
@@ -1057,7 +1057,7 @@ int mga_dma_blit( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( blit, (drm_mga_blit_t *)data, sizeof(blit) );
+	DRM_COPY_FROM_USER_IOCTL( blit, (drm_mga_blit_t __user *)data, sizeof(blit) );
 
 	if ( sarea_priv->nbox > MGA_NR_SAREA_CLIPRECTS )
 		sarea_priv->nbox = MGA_NR_SAREA_CLIPRECTS;
@@ -1088,7 +1088,7 @@ int mga_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_mga_getparam_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_mga_getparam_t __user *)data,
 			     sizeof(param) );
 
 	DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID );
diff --git a/shared-core/r128_cce.c b/shared-core/r128_cce.c
index bf4b4d95..22d38b70 100644
--- a/shared-core/r128_cce.c
+++ b/shared-core/r128_cce.c
@@ -632,7 +632,7 @@ int r128_cce_init( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t *)data, sizeof(init) );
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case R128_INIT_CCE:
@@ -675,7 +675,7 @@ int r128_cce_stop( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL(stop, (drm_r128_cce_stop_t *)data, sizeof(stop) );
+	DRM_COPY_FROM_USER_IOCTL(stop, (drm_r128_cce_stop_t __user *)data, sizeof(stop) );
 
 	/* Flush any pending CCE commands.  This ensures any outstanding
 	 * commands are exectuted by the engine before we turn it off.
@@ -912,11 +912,12 @@ int r128_cce_buffers( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_device_dma_t *dma = dev->dma;
 	int ret = 0;
+	drm_dma_t __user *argp = (void __user *)data;
 	drm_dma_t d;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *) data, sizeof(d) );
+	DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) );
 
 	/* Please don't send us buffers.
 	 */
@@ -940,7 +941,7 @@ int r128_cce_buffers( DRM_IOCTL_ARGS )
 		ret = r128_cce_get_buffers( filp, dev, &d );
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_dma_t *) data, d, sizeof(d) );
+	DRM_COPY_TO_USER_IOCTL(argp, d, sizeof(d) );
 
 	return ret;
 }
diff --git a/shared-core/r128_drm.h b/shared-core/r128_drm.h
index ae51de34..0cba17d1 100644
--- a/shared-core/r128_drm.h
+++ b/shared-core/r128_drm.h
@@ -308,14 +308,14 @@ typedef struct drm_r128_depth {
 		R128_READ_PIXELS	= 0x04
 	} func;
 	int n;
-	int *x;
-	int *y;
-	unsigned int *buffer;
-	unsigned char *mask;
+	int __user *x;
+	int __user *y;
+	unsigned int __user *buffer;
+	unsigned char __user *mask;
 } drm_r128_depth_t;
 
 typedef struct drm_r128_stipple {
-	unsigned int *mask;
+	unsigned int __user *mask;
 } drm_r128_stipple_t;
 
 typedef struct drm_r128_indirect {
@@ -339,7 +339,7 @@ typedef struct drm_r128_fullscreen {
 
 typedef struct drm_r128_getparam {
 	int param;
-	void *value;
+	void __user *value;
 } drm_r128_getparam_t;
 
 #endif
diff --git a/shared-core/r128_state.c b/shared-core/r128_state.c
index 6ec11b02..34ebcae1 100644
--- a/shared-core/r128_state.c
+++ b/shared-core/r128_state.c
@@ -1271,7 +1271,7 @@ int r128_cce_clear( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( clear, (drm_r128_clear_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( clear, (drm_r128_clear_t __user *) data,
 			     sizeof(clear) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -1386,7 +1386,7 @@ int r128_cce_vertex( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_r128_vertex_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_r128_vertex_t __user *) data,
 			     sizeof(vertex) );
 
 	DRM_DEBUG( "pid=%d index=%d count=%d discard=%d\n",
@@ -1447,7 +1447,7 @@ int r128_cce_indices( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( elts, (drm_r128_indices_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( elts, (drm_r128_indices_t __user *) data,
 			     sizeof(elts) );
 
 	DRM_DEBUG( "pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID,
@@ -1512,7 +1512,7 @@ int r128_cce_blit( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( blit, (drm_r128_blit_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( blit, (drm_r128_blit_t __user *) data,
 			     sizeof(blit) );
 
 	DRM_DEBUG( "pid=%d index=%d\n", DRM_CURRENTPID, blit.idx );
@@ -1541,7 +1541,7 @@ int r128_cce_depth( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( depth, (drm_r128_depth_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( depth, (drm_r128_depth_t __user *) data,
 			     sizeof(depth) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -1571,7 +1571,7 @@ int r128_cce_stipple( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_r128_stipple_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_r128_stipple_t __user *) data,
 			     sizeof(stipple) );
 
 	if ( DRM_COPY_FROM_USER( &mask, stipple.mask,
@@ -1605,7 +1605,7 @@ int r128_cce_indirect( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_r128_indirect_t *) data,
+	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_r128_indirect_t __user *) data,
 			     sizeof(indirect) );
 
 	DRM_DEBUG( "indirect: idx=%d s=%d e=%d d=%d\n",
@@ -1674,7 +1674,7 @@ int r128_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_r128_getparam_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_r128_getparam_t __user *)data,
 			     sizeof(param) );
 
 	DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID );
diff --git a/shared-core/radeon_cp.c b/shared-core/radeon_cp.c
index e145c78e..f6964908 100644
--- a/shared-core/radeon_cp.c
+++ b/shared-core/radeon_cp.c
@@ -1358,7 +1358,7 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t *)data, sizeof(init) );
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case RADEON_INIT_CP:
@@ -1407,7 +1407,7 @@ int radeon_cp_stop( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( stop, (drm_radeon_cp_stop_t *)data, sizeof(stop) );
+	DRM_COPY_FROM_USER_IOCTL( stop, (drm_radeon_cp_stop_t __user *)data, sizeof(stop) );
 
 	if (!dev_priv->cp_running)
 		return 0;
@@ -1712,11 +1712,12 @@ int radeon_cp_buffers( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_device_dma_t *dma = dev->dma;
 	int ret = 0;
+	drm_dma_t __user *argp = (void __user *)data;
 	drm_dma_t d;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( d, (drm_dma_t *)data, sizeof(d) );
+	DRM_COPY_FROM_USER_IOCTL( d, argp, sizeof(d) );
 
 	/* Please don't send us buffers.
 	 */
@@ -1740,7 +1741,7 @@ int radeon_cp_buffers( DRM_IOCTL_ARGS )
 		ret = radeon_cp_get_buffers( filp, dev, &d );
 	}
 
-	DRM_COPY_TO_USER_IOCTL( (drm_dma_t *)data, d, sizeof(d) );
+	DRM_COPY_TO_USER_IOCTL( argp, d, sizeof(d) );
 
 	return ret;
 }
diff --git a/shared-core/radeon_drm.h b/shared-core/radeon_drm.h
index 735e04ef..e447308b 100644
--- a/shared-core/radeon_drm.h
+++ b/shared-core/radeon_drm.h
@@ -482,7 +482,7 @@ typedef struct drm_radeon_clear {
 	unsigned int clear_depth;
 	unsigned int color_mask;
 	unsigned int depth_mask;   /* misnamed field:  should be stencil */
-	drm_radeon_clear_rect_t *depth_boxes;
+	drm_radeon_clear_rect_t __user *depth_boxes;
 } drm_radeon_clear_t;
 
 typedef struct drm_radeon_vertex {
@@ -508,9 +508,9 @@ typedef struct drm_radeon_vertex2 {
 	int idx;			/* Index of vertex buffer */
 	int discard;			/* Client finished with buffer? */
 	int nr_states;
-	drm_radeon_state_t *state;
+	drm_radeon_state_t __user *state;
 	int nr_prims;
-	drm_radeon_prim_t *prim;
+	drm_radeon_prim_t __user *prim;
 } drm_radeon_vertex2_t;
 
 /* v1.3 - obsoletes drm_radeon_vertex2
@@ -525,15 +525,15 @@ typedef struct drm_radeon_vertex2 {
  */
 typedef struct drm_radeon_cmd_buffer {
 	int bufsz;
-	char *buf;
+	char __user *buf;
 	int nbox;
-	drm_clip_rect_t *boxes;
+	drm_clip_rect_t __user *boxes;
 } drm_radeon_cmd_buffer_t;
 
 typedef struct drm_radeon_tex_image {
 	unsigned int x, y;		/* Blit coordinates */
 	unsigned int width, height;
-	const void *data;
+	const void __user *data;
 } drm_radeon_tex_image_t;
 
 typedef struct drm_radeon_texture {
@@ -542,11 +542,11 @@ typedef struct drm_radeon_texture {
 	int format;
 	int width;			/* Texture image coordinates */
 	int height;
-	drm_radeon_tex_image_t *image;
+	drm_radeon_tex_image_t __user *image;
 } drm_radeon_texture_t;
 
 typedef struct drm_radeon_stipple {
-	unsigned int *mask;
+	unsigned int __user *mask;
 } drm_radeon_stipple_t;
 
 typedef struct drm_radeon_indirect {
@@ -576,7 +576,7 @@ typedef struct drm_radeon_indirect {
 
 typedef struct drm_radeon_getparam {
 	int param;
-	void *value;
+	void __user *value;
 } drm_radeon_getparam_t;
 
 /* 1.6: Set up a memory manager for regions of shared memory:
@@ -588,7 +588,7 @@ typedef struct drm_radeon_mem_alloc {
 	int region;
 	int alignment;
 	int size;
-	int *region_offset;	/* offset from start of fb or GART */
+	int __user *region_offset;	/* offset from start of fb or GART */
 } drm_radeon_mem_alloc_t;
 
 typedef struct drm_radeon_mem_free {
@@ -606,7 +606,7 @@ typedef struct drm_radeon_mem_init_heap {
 /* 1.6: Userspace can request & wait on irq's:
  */
 typedef struct drm_radeon_irq_emit {
-	int *irq_seq;
+	int __user *irq_seq;
 } drm_radeon_irq_emit_t;
 
 typedef struct drm_radeon_irq_wait {
diff --git a/shared-core/radeon_drv.h b/shared-core/radeon_drv.h
index 45eafd05..e24e0ec0 100644
--- a/shared-core/radeon_drv.h
+++ b/shared-core/radeon_drv.h
@@ -887,7 +887,7 @@ do {									\
 
 #define OUT_RING_USER_TABLE( tab, sz ) do {			\
 	int _size = (sz);					\
-	int *_tab = (tab);					\
+	int __user *_tab = (tab);					\
 								\
 	if (write + _size > mask) {				\
 		int i = (mask+1) - write;			\
diff --git a/shared-core/radeon_irq.c b/shared-core/radeon_irq.c
index f503153a..51d19493 100644
--- a/shared-core/radeon_irq.c
+++ b/shared-core/radeon_irq.c
@@ -187,7 +187,7 @@ int radeon_irq_emit( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( emit, (drm_radeon_irq_emit_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( emit, (drm_radeon_irq_emit_t __user *)data,
 				  sizeof(emit) );
 
 	result = radeon_emit_irq( dev );
@@ -214,7 +214,7 @@ int radeon_irq_wait( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_radeon_irq_wait_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( irqwait, (drm_radeon_irq_wait_t __user*)data,
 				  sizeof(irqwait) );
 
 	return radeon_wait_irq( dev, irqwait.irq_seq );
diff --git a/shared-core/radeon_mem.c b/shared-core/radeon_mem.c
index 96b76ae0..28995740 100644
--- a/shared-core/radeon_mem.c
+++ b/shared-core/radeon_mem.c
@@ -233,7 +233,7 @@ int radeon_mem_alloc( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( alloc, (drm_radeon_mem_alloc_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( alloc, (drm_radeon_mem_alloc_t __user *)data,
 				  sizeof(alloc) );
 
 	heap = get_heap( dev_priv, alloc.region );
@@ -275,7 +275,7 @@ int radeon_mem_free( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( memfree, (drm_radeon_mem_free_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( memfree, (drm_radeon_mem_free_t __user *)data,
 				  sizeof(memfree) );
 
 	heap = get_heap( dev_priv, memfree.region );
@@ -305,7 +305,7 @@ int radeon_mem_init_heap( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( initheap, (drm_radeon_mem_init_heap_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( initheap, (drm_radeon_mem_init_heap_t __user *)data,
 				  sizeof(initheap) );
 
 	heap = get_heap( dev_priv, initheap.region );
diff --git a/shared-core/radeon_state.c b/shared-core/radeon_state.c
index 4d760e92..10a6629a 100644
--- a/shared-core/radeon_state.c
+++ b/shared-core/radeon_state.c
@@ -63,7 +63,7 @@ static __inline__ int radeon_check_and_fixup_offset( drm_radeon_private_t *dev_p
 
 static __inline__ int radeon_check_and_fixup_offset_user( drm_radeon_private_t *dev_priv,
 							  drm_file_t *filp_priv,
-							  u32 *offset ) {
+							  u32 __user *offset ) {
 	u32 off;
 
 	DRM_GET_USER_UNCHECKED( off, offset );
@@ -79,7 +79,7 @@ static __inline__ int radeon_check_and_fixup_offset_user( drm_radeon_private_t *
 static __inline__ int radeon_check_and_fixup_packets( drm_radeon_private_t *dev_priv,
 						      drm_file_t *filp_priv,
 						      int id,
-						      u32 *data ) {
+						      u32 __user *data ) {
 	switch ( id ) {
 
 	case RADEON_EMIT_PP_MISC:
@@ -217,7 +217,8 @@ static __inline__ int radeon_check_and_fixup_packet3( drm_radeon_private_t *dev_
 						      drm_file_t *filp_priv,
 						      drm_radeon_cmd_buffer_t *cmdbuf,
 						      unsigned int *cmdsz ) {
-	u32 tmp[4], *cmd = ( u32* )cmdbuf->buf;
+	u32 tmp[4];
+	u32 __user *cmd = (u32 __user *)cmdbuf->buf;
 
 	if ( DRM_COPY_FROM_USER_UNCHECKED( tmp, cmd, sizeof( tmp ) ) ) {
 		DRM_ERROR( "Failed to copy data from user space\n" );
@@ -1339,7 +1340,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 	drm_buf_t *buf;
 	u32 format;
 	u32 *buffer;
-	const u8 *data;
+	const u8 __user *data;
 	int size, dwords, tex_width, blit_width;
 	u32 height;
 	int i;
@@ -1417,7 +1418,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		 * update them for a multi-pass texture blit.
 		 */
 		height = image->height;
-		data = (const u8 *)image->data;
+		data = (const u8 __user *)image->data;
 		
 		size = height * blit_width;
 
@@ -1499,7 +1500,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		/* Update the input parameters for next time */
 		image->y += height;
 		image->height -= height;
-		image->data = (const u8 *)image->data + size;
+		image->data = (const u8 __user *)image->data + size;
 	} while (image->height > 0);
 
 	/* Flush the pixel cache after the blit completes.  This ensures
@@ -1550,7 +1551,7 @@ int radeon_cp_clear( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( clear, (drm_radeon_clear_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( clear, (drm_radeon_clear_t __user *)data,
 			     sizeof(clear) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -1671,7 +1672,7 @@ int radeon_cp_vertex( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex_t __user *)data,
 			     sizeof(vertex) );
 
 	DRM_DEBUG( "pid=%d index=%d count=%d discard=%d\n",
@@ -1762,7 +1763,7 @@ int radeon_cp_indices( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( elts, (drm_radeon_indices_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( elts, (drm_radeon_indices_t __user *)data,
 			     sizeof(elts) );
 
 	DRM_DEBUG( "pid=%d index=%d start=%d end=%d discard=%d\n",
@@ -1853,7 +1854,7 @@ int radeon_cp_texture( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( tex, (drm_radeon_texture_t *)data, sizeof(tex) );
+	DRM_COPY_FROM_USER_IOCTL( tex, (drm_radeon_texture_t __user *)data, sizeof(tex) );
 
 	if ( tex.image == NULL ) {
 		DRM_ERROR( "null texture image!\n" );
@@ -1861,7 +1862,7 @@ int radeon_cp_texture( DRM_IOCTL_ARGS )
 	}
 
 	if ( DRM_COPY_FROM_USER( &image,
-			     (drm_radeon_tex_image_t *)tex.image,
+			     (drm_radeon_tex_image_t __user *)tex.image,
 			     sizeof(image) ) )
 		return DRM_ERR(EFAULT);
 
@@ -1883,7 +1884,7 @@ int radeon_cp_stipple( DRM_IOCTL_ARGS )
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_radeon_stipple_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( stipple, (drm_radeon_stipple_t __user *)data,
 			     sizeof(stipple) );
 
 	if ( DRM_COPY_FROM_USER( &mask, stipple.mask, 32 * sizeof(u32) ) )
@@ -1913,7 +1914,7 @@ int radeon_cp_indirect( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_radeon_indirect_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( indirect, (drm_radeon_indirect_t __user *)data,
 			     sizeof(indirect) );
 
 	DRM_DEBUG( "indirect: idx=%d s=%d e=%d d=%d\n",
@@ -1993,7 +1994,7 @@ int radeon_cp_vertex2( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex2_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( vertex, (drm_radeon_vertex2_t __user *)data,
 			     sizeof(vertex) );
 
 	DRM_DEBUG( "pid=%d index=%d discard=%d\n",
@@ -2086,7 +2087,7 @@ static int radeon_emit_packets(
 {
 	int id = (int)header.packet.packet_id;
 	int sz, reg;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	RING_LOCALS;
    
 	if (id >= RADEON_MAX_STATE_PACKETS)
@@ -2121,7 +2122,7 @@ static __inline__ int radeon_emit_scalars(
 	drm_radeon_cmd_buffer_t *cmdbuf )
 {
 	int sz = header.scalars.count;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	int start = header.scalars.offset;
 	int stride = header.scalars.stride;
 	RING_LOCALS;
@@ -2145,7 +2146,7 @@ static __inline__ int radeon_emit_scalars2(
 	drm_radeon_cmd_buffer_t *cmdbuf )
 {
 	int sz = header.scalars.count;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	int start = ((unsigned int)header.scalars.offset) + 0x100;
 	int stride = header.scalars.stride;
 	RING_LOCALS;
@@ -2167,7 +2168,7 @@ static __inline__ int radeon_emit_vectors(
 	drm_radeon_cmd_buffer_t *cmdbuf )
 {
 	int sz = header.vectors.count;
-	int *data = (int *)cmdbuf->buf;
+	int __user *data = (int __user *)cmdbuf->buf;
 	int start = header.vectors.offset;
 	int stride = header.vectors.stride;
 	RING_LOCALS;
@@ -2191,7 +2192,8 @@ static int radeon_emit_packet3( drm_device_t *dev,
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
 	unsigned int cmdsz;
-	int *cmd = (int *)cmdbuf->buf, ret;
+	int __user *cmd = (int __user *)cmdbuf->buf;
+	int ret;
 	RING_LOCALS;
 
 	DRM_DEBUG("\n");
@@ -2220,8 +2222,9 @@ static int radeon_emit_packet3_cliprect( drm_device_t *dev,
 	drm_radeon_private_t *dev_priv = dev->dev_private;
 	drm_clip_rect_t box;
 	unsigned int cmdsz;
-	int *cmd = (int *)cmdbuf->buf, ret;
-	drm_clip_rect_t *boxes = cmdbuf->boxes;
+	int __user *cmd = (int __user *)cmdbuf->buf;
+	int ret;
+	drm_clip_rect_t __user *boxes = cmdbuf->boxes;
 	int i = 0;
 	RING_LOCALS;
 
@@ -2325,7 +2328,7 @@ int radeon_cp_cmdbuf( DRM_IOCTL_ARGS )
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_radeon_cmd_buffer_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( cmdbuf, (drm_radeon_cmd_buffer_t __user *)data,
 			     sizeof(cmdbuf) );
 
 	RING_SPACE_TEST_WITH_RETURN( dev_priv );
@@ -2344,7 +2347,7 @@ int radeon_cp_cmdbuf( DRM_IOCTL_ARGS )
 
 	while ( cmdbuf.bufsz >= sizeof(header) ) {
 		
-		if (DRM_GET_USER_UNCHECKED( header.i, (int *)cmdbuf.buf )) {
+		if (DRM_GET_USER_UNCHECKED( header.i, (int __user *)cmdbuf.buf )) {
 			DRM_ERROR("__get_user %p\n", cmdbuf.buf);
 			return DRM_ERR(EFAULT);
 		}
@@ -2455,7 +2458,7 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS )
 		return DRM_ERR(EINVAL);
 	}
 
-	DRM_COPY_FROM_USER_IOCTL( param, (drm_radeon_getparam_t *)data,
+	DRM_COPY_FROM_USER_IOCTL( param, (drm_radeon_getparam_t __user *)data,
 			     sizeof(param) );
 
 	DRM_DEBUG( "pid=%d\n", DRM_CURRENTPID );
@@ -2530,7 +2533,7 @@ int radeon_cp_setparam( DRM_IOCTL_ARGS ) {
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
 
-	DRM_COPY_FROM_USER_IOCTL( sp, ( drm_radeon_setparam_t* )data,
+	DRM_COPY_FROM_USER_IOCTL( sp, ( drm_radeon_setparam_t __user * )data,
 				  sizeof( sp ) );
 
 	switch( sp.param ) {
diff --git a/shared-core/sis_mm.c b/shared-core/sis_mm.c
index 7b10db97..9b6311a9 100644
--- a/shared-core/sis_mm.c
+++ b/shared-core/sis_mm.c
@@ -94,9 +94,10 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 {
 	drm_sis_mem_t fb;
 	struct sis_memreq req;
+	drm_sis_mem_t __user *argp = (void __user *)data;
 	int retval = 0;
 
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, argp, sizeof(fb));
 
 	req.size = fb.size;
 	sis_malloc(&req);
@@ -115,7 +116,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 		fb.free = 0;
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, fb, sizeof(fb));
+	DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb));
 
 	DRM_DEBUG("alloc fb, size = %d, offset = %ld\n", fb.size, req.offset);
 
@@ -127,7 +128,7 @@ int sis_fb_free( DRM_IOCTL_ARGS )
 	drm_sis_mem_t fb;
 	int retval = 0;
 
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t __user *)data, sizeof(fb));
 
 	if (!fb.free)
 		return DRM_ERR(EINVAL);
@@ -159,7 +160,7 @@ int sis_fb_init( DRM_IOCTL_ARGS )
 	drm_sis_private_t *dev_priv = dev->dev_private;
 	drm_sis_fb_t fb;
 
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_fb_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_fb_t __user *)data, sizeof(fb));
 
 	if (dev_priv == NULL) {
 		dev->dev_private = DRM(calloc)(1, sizeof(drm_sis_private_t),
@@ -183,6 +184,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 {
 	DRM_DEVICE;
 	drm_sis_private_t *dev_priv = dev->dev_private;
+	drm_sis_mem_t __user *argp = (void __user *)data;
 	drm_sis_mem_t fb;
 	PMemBlock block;
 	int retval = 0;
@@ -190,7 +192,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->FBHeap == NULL)
 		return DRM_ERR(EINVAL);
   
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, argp, sizeof(fb));
   
 	block = mmAllocMem(dev_priv->FBHeap, fb.size, 0, 0);
 	if (block) {
@@ -208,7 +210,7 @@ int sis_fb_alloc( DRM_IOCTL_ARGS )
 		fb.free = 0;
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, fb, sizeof(fb));
+	DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb));
 
 	DRM_DEBUG("alloc fb, size = %d, offset = %d\n", fb.size, fb.offset);
 
@@ -224,7 +226,7 @@ int sis_fb_free( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->FBHeap == NULL)
 		return DRM_ERR(EINVAL);
 
-	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t *)data, sizeof(fb));
+	DRM_COPY_FROM_USER_IOCTL(fb, (drm_sis_mem_t __user *)data, sizeof(fb));
 
 	if (!mmBlockInHeap(dev_priv->FBHeap, (PMemBlock)fb.free))
 		return DRM_ERR(EINVAL);
@@ -259,7 +261,7 @@ int sis_ioctl_agp_init( DRM_IOCTL_ARGS )
 	if (dev_priv->AGPHeap != NULL)
 		return DRM_ERR(EINVAL);
 
-	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_agp_t *)data, sizeof(agp));
+	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_agp_t __user *)data, sizeof(agp));
 
 	dev_priv->AGPHeap = mmInit(agp.offset, agp.size);
 
@@ -272,6 +274,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS )
 {
 	DRM_DEVICE;
 	drm_sis_private_t *dev_priv = dev->dev_private;
+	drm_sis_mem_t __user *argp = (void __user *)data;
 	drm_sis_mem_t agp;
 	PMemBlock block;
 	int retval = 0;
@@ -279,7 +282,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->AGPHeap == NULL)
 		return DRM_ERR(EINVAL);
   
-	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t *)data, sizeof(agp));
+	DRM_COPY_FROM_USER_IOCTL(agp, argp, sizeof(agp));
   
 	block = mmAllocMem(dev_priv->AGPHeap, agp.size, 0, 0);
 	if (block) {
@@ -297,7 +300,7 @@ int sis_ioctl_agp_alloc( DRM_IOCTL_ARGS )
 		agp.free = 0;
 	}
 
-	DRM_COPY_TO_USER_IOCTL((drm_sis_mem_t *)data, agp, sizeof(agp));
+	DRM_COPY_TO_USER_IOCTL(argp, agp, sizeof(agp));
 
 	DRM_DEBUG("alloc agp, size = %d, offset = %d\n", agp.size, agp.offset);
 
@@ -313,7 +316,7 @@ int sis_ioctl_agp_free( DRM_IOCTL_ARGS )
 	if (dev_priv == NULL || dev_priv->AGPHeap == NULL)
 		return DRM_ERR(EINVAL);
 
-	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t *)data, sizeof(agp));
+	DRM_COPY_FROM_USER_IOCTL(agp, (drm_sis_mem_t __user *)data, sizeof(agp));
 
 	if (!mmBlockInHeap(dev_priv->AGPHeap, (PMemBlock)agp.free))
 		return DRM_ERR(EINVAL);