Add __user annotations from kernel

10 files changed, 58 insertions, 48 deletions

diff --git a/linux-core/drmP.h b/linux-core/drmP.h
index e30dd6d9..a06086eb 100644
--- a/linux-core/drmP.h
+++ b/linux-core/drmP.h
@@ -261,6 +261,10 @@ static inline struct class_simple *class_simple_create(struct module *owner, cha
 
 #endif
 
+#ifndef __user
+#define __user
+#endif
+
 #ifndef REMAP_PAGE_RANGE_5_ARGS
 #define DRM_RPR_ARG(vma)
 #else
diff --git a/linux-core/i830_dma.c b/linux-core/i830_dma.c
index c2fd8c26..48c6ef51 100644
--- a/linux-core/i830_dma.c
+++ b/linux-core/i830_dma.c
@@ -40,6 +40,7 @@
 #include <linux/interrupt.h>	/* For task queue support */
 #include <linux/pagemap.h>     /* For FASTCALL on unlock_page() */
 #include <linux/delay.h>
+#include <asm/uaccess.h>
 
 #ifdef DO_MUNMAP_4_ARGS
 #define DO_MUNMAP(m, a, l)	do_munmap(m, a, l, 1)
@@ -167,7 +168,7 @@ static int i830_map_buffer(drm_buf_t *buf, struct file *filp)
 	old_fops = filp->f_op;
 	filp->f_op = &i830_buffer_fops;
 	dev_priv->mmap_buffer = buf;
-	buf_priv->virtual = (void *)do_mmap(filp, 0, buf->total, 
+	buf_priv->virtual = (void __user *)do_mmap(filp, 0, buf->total, 
 					    PROT_READ|PROT_WRITE,
 					    MAP_SHARED, 
 					    buf->bus_address);
@@ -469,7 +470,7 @@ static int i830_dma_initialize(drm_device_t *dev,
 }
 
 int i830_dma_init(struct inode *inode, struct file *filp,
-		  unsigned int cmd, unsigned long arg)
+		  unsigned int cmd, unsigned long __user arg)
 {
    	drm_file_t *priv = filp->private_data;
    	drm_device_t *dev = priv->dev;
@@ -477,7 +478,7 @@ int i830_dma_init(struct inode *inode, struct file *filp,
    	drm_i830_init_t init;
    	int retcode = 0;
 	
-  	if (copy_from_user(&init, (drm_i830_init_t *)arg, sizeof(init)))
+  	if (copy_from_user(&init, (void __user *)arg, sizeof(init)))
 		return -EFAULT;
 	
    	switch(init.func) {
@@ -1321,7 +1322,7 @@ void i830_reclaim_buffers( struct file *filp )
 }
 
 int i830_flush_ioctl(struct inode *inode, struct file *filp, 
-		     unsigned int cmd, unsigned long arg)
+		     unsigned int cmd, unsigned long __user arg)
 {
    	drm_file_t	  *priv	  = filp->private_data;
    	drm_device_t	  *dev	  = priv->dev;
@@ -1336,7 +1337,7 @@ int i830_flush_ioctl(struct inode *inode, struct file *filp,
 }
 
 int i830_dma_vertex(struct inode *inode, struct file *filp,
-	       unsigned int cmd, unsigned long arg)
+	       unsigned int cmd, unsigned long __user arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1347,7 +1348,7 @@ int i830_dma_vertex(struct inode *inode, struct file *filp,
      					dev_priv->sarea_priv; 
 	drm_i830_vertex_t vertex;
 
-	if (copy_from_user(&vertex, (drm_i830_vertex_t *)arg, sizeof(vertex)))
+	if (copy_from_user(&vertex, (drm_i830_vertex_t __user *)arg, sizeof(vertex)))
 		return -EFAULT;
 
    	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1371,13 +1372,13 @@ int i830_dma_vertex(struct inode *inode, struct file *filp,
 }
 
 int i830_clear_bufs(struct inode *inode, struct file *filp,
-		   unsigned int cmd, unsigned long arg)
+		   unsigned int cmd, unsigned long __user arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_i830_clear_t clear;
 
-   	if (copy_from_user(&clear, (drm_i830_clear_t *)arg, sizeof(clear)))
+   	if (copy_from_user(&clear, (drm_i830_clear_t __user *)arg, sizeof(clear)))
 		return -EFAULT;
    
    	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1398,7 +1399,7 @@ int i830_clear_bufs(struct inode *inode, struct file *filp,
 }
 
 int i830_swap_bufs(struct inode *inode, struct file *filp,
-		  unsigned int cmd, unsigned long arg)
+		  unsigned int cmd, unsigned long __user arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1462,7 +1463,7 @@ int i830_flip_bufs(struct inode *inode, struct file *filp,
 }
 
 int i830_getage(struct inode *inode, struct file *filp, unsigned int cmd,
-		unsigned long arg)
+		unsigned long __user arg)
 {
    	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1476,7 +1477,7 @@ int i830_getage(struct inode *inode, struct file *filp, unsigned int cmd,
 }
 
 int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
-		unsigned long arg)
+		unsigned long __user arg)
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1488,7 +1489,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
      					dev_priv->sarea_priv; 
 
 	DRM_DEBUG("getbuf\n");
-   	if (copy_from_user(&d, (drm_i830_dma_t *)arg, sizeof(d)))
+   	if (copy_from_user(&d, (drm_i830_dma_t __user *)arg, sizeof(d)))
 		return -EFAULT;
    
 	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1503,7 +1504,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
 	DRM_DEBUG("i830_dma: %d returning %d, granted = %d\n",
 		  current->pid, retcode, d.granted);
 
-	if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d)))
+	if (copy_to_user((drm_dma_t __user *)arg, &d, sizeof(d)))
 		return -EFAULT;
    	sarea_priv->last_dispatch = (int) hw_status[5];
 
@@ -1513,7 +1514,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
 int i830_copybuf(struct inode *inode,
 		 struct file *filp, 
 		 unsigned int cmd,
-		 unsigned long arg)
+		 unsigned long __user arg)
 {
 	/* Never copy - 2.4.x doesn't need it */
 	return 0;
@@ -1528,7 +1529,7 @@ int i830_docopy(struct inode *inode, struct file *filp, unsigned int cmd,
 
 
 int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
-		      unsigned long arg )
+		      unsigned long __user arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1541,7 +1542,7 @@ int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
 		return -EINVAL;
 	}
 
-	if (copy_from_user(&param, (drm_i830_getparam_t *)arg, sizeof(param) ))
+	if (copy_from_user(&param, (drm_i830_getparam_t __user *)arg, sizeof(param) ))
 		return -EFAULT;
 
 	switch( param.param ) {
@@ -1562,7 +1563,7 @@ int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
 
 
 int i830_setparam( struct inode *inode, struct file *filp, unsigned int cmd,
-		   unsigned long arg )
+		   unsigned long __user arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1574,7 +1575,7 @@ int i830_setparam( struct inode *inode, struct file *filp, unsigned int cmd,
 		return -EINVAL;
 	}
 
-	if (copy_from_user(&param, (drm_i830_setparam_t *)arg, sizeof(param) ))
+	if (copy_from_user(&param, (drm_i830_setparam_t __user *)arg, sizeof(param) ))
 		return -EFAULT;
 
 	switch( param.param ) {
diff --git a/linux-core/i830_drm.h b/linux-core/i830_drm.h
index b87c3371..1bd45994 100644
--- a/linux-core/i830_drm.h
+++ b/linux-core/i830_drm.h
@@ -290,11 +290,11 @@ typedef struct _drm_i830_vertex {
 typedef struct _drm_i830_copy_t {
    	int idx;		/* buffer index */
 	int used;		/* nr bytes in use */
-	void *address;		/* Address to copy from */
+	void __user *address;		/* Address to copy from */
 } drm_i830_copy_t;
 
 typedef struct drm_i830_dma {
-	void *virtual;
+	void __user *virtual;
 	int request_idx;
 	int request_size;
 	int granted;
@@ -304,7 +304,7 @@ typedef struct drm_i830_dma {
 /* 1.3: Userspace can request & wait on irq's:
  */
 typedef struct drm_i830_irq_emit {
-	int *irq_seq;
+	int __user *irq_seq;
 } drm_i830_irq_emit_t;
 
 typedef struct drm_i830_irq_wait {
@@ -318,7 +318,7 @@ typedef struct drm_i830_irq_wait {
 
 typedef struct drm_i830_getparam {
 	int param;
-	int *value;
+	int __user *value;
 } drm_i830_getparam_t;
 
 
diff --git a/linux-core/i830_drv.h b/linux-core/i830_drv.h
index b611c133..c6d805fc 100644
--- a/linux-core/i830_drv.h
+++ b/linux-core/i830_drv.h
@@ -36,7 +36,7 @@ typedef struct drm_i830_buf_priv {
    	u32 *in_use;
    	int my_use_idx;
 	int currently_mapped;
-	void *virtual;
+	void __user *virtual;
 	void *kernel_virtual;
 } drm_i830_buf_priv_t;
 
diff --git a/linux-core/i830_irq.c b/linux-core/i830_irq.c
index ae27f3bd..fcf2dedd 100644
--- a/linux-core/i830_irq.c
+++ b/linux-core/i830_irq.c
@@ -122,7 +122,7 @@ int i830_wait_irq(drm_device_t *dev, int irq_nr)
 /* Needs the lock as it touches the ring.
  */
 int i830_irq_emit( struct inode *inode, struct file *filp, unsigned int cmd,
-		   unsigned long arg )
+		   unsigned long __user arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
diff --git a/linux/drmP.h b/linux/drmP.h
index e30dd6d9..a06086eb 100644
--- a/linux/drmP.h
+++ b/linux/drmP.h
@@ -261,6 +261,10 @@ static inline struct class_simple *class_simple_create(struct module *owner, cha
 
 #endif
 
+#ifndef __user
+#define __user
+#endif
+
 #ifndef REMAP_PAGE_RANGE_5_ARGS
 #define DRM_RPR_ARG(vma)
 #else
diff --git a/linux/i830_dma.c b/linux/i830_dma.c
index c2fd8c26..48c6ef51 100644
--- a/linux/i830_dma.c
+++ b/linux/i830_dma.c
@@ -40,6 +40,7 @@
 #include <linux/interrupt.h>	/* For task queue support */
 #include <linux/pagemap.h>     /* For FASTCALL on unlock_page() */
 #include <linux/delay.h>
+#include <asm/uaccess.h>
 
 #ifdef DO_MUNMAP_4_ARGS
 #define DO_MUNMAP(m, a, l)	do_munmap(m, a, l, 1)
@@ -167,7 +168,7 @@ static int i830_map_buffer(drm_buf_t *buf, struct file *filp)
 	old_fops = filp->f_op;
 	filp->f_op = &i830_buffer_fops;
 	dev_priv->mmap_buffer = buf;
-	buf_priv->virtual = (void *)do_mmap(filp, 0, buf->total, 
+	buf_priv->virtual = (void __user *)do_mmap(filp, 0, buf->total, 
 					    PROT_READ|PROT_WRITE,
 					    MAP_SHARED, 
 					    buf->bus_address);
@@ -469,7 +470,7 @@ static int i830_dma_initialize(drm_device_t *dev,
 }
 
 int i830_dma_init(struct inode *inode, struct file *filp,
-		  unsigned int cmd, unsigned long arg)
+		  unsigned int cmd, unsigned long __user arg)
 {
    	drm_file_t *priv = filp->private_data;
    	drm_device_t *dev = priv->dev;
@@ -477,7 +478,7 @@ int i830_dma_init(struct inode *inode, struct file *filp,
    	drm_i830_init_t init;
    	int retcode = 0;
 	
-  	if (copy_from_user(&init, (drm_i830_init_t *)arg, sizeof(init)))
+  	if (copy_from_user(&init, (void __user *)arg, sizeof(init)))
 		return -EFAULT;
 	
    	switch(init.func) {
@@ -1321,7 +1322,7 @@ void i830_reclaim_buffers( struct file *filp )
 }
 
 int i830_flush_ioctl(struct inode *inode, struct file *filp, 
-		     unsigned int cmd, unsigned long arg)
+		     unsigned int cmd, unsigned long __user arg)
 {
    	drm_file_t	  *priv	  = filp->private_data;
    	drm_device_t	  *dev	  = priv->dev;
@@ -1336,7 +1337,7 @@ int i830_flush_ioctl(struct inode *inode, struct file *filp,
 }
 
 int i830_dma_vertex(struct inode *inode, struct file *filp,
-	       unsigned int cmd, unsigned long arg)
+	       unsigned int cmd, unsigned long __user arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1347,7 +1348,7 @@ int i830_dma_vertex(struct inode *inode, struct file *filp,
      					dev_priv->sarea_priv; 
 	drm_i830_vertex_t vertex;
 
-	if (copy_from_user(&vertex, (drm_i830_vertex_t *)arg, sizeof(vertex)))
+	if (copy_from_user(&vertex, (drm_i830_vertex_t __user *)arg, sizeof(vertex)))
 		return -EFAULT;
 
    	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1371,13 +1372,13 @@ int i830_dma_vertex(struct inode *inode, struct file *filp,
 }
 
 int i830_clear_bufs(struct inode *inode, struct file *filp,
-		   unsigned int cmd, unsigned long arg)
+		   unsigned int cmd, unsigned long __user arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
 	drm_i830_clear_t clear;
 
-   	if (copy_from_user(&clear, (drm_i830_clear_t *)arg, sizeof(clear)))
+   	if (copy_from_user(&clear, (drm_i830_clear_t __user *)arg, sizeof(clear)))
 		return -EFAULT;
    
    	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1398,7 +1399,7 @@ int i830_clear_bufs(struct inode *inode, struct file *filp,
 }
 
 int i830_swap_bufs(struct inode *inode, struct file *filp,
-		  unsigned int cmd, unsigned long arg)
+		  unsigned int cmd, unsigned long __user arg)
 {
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->dev;
@@ -1462,7 +1463,7 @@ int i830_flip_bufs(struct inode *inode, struct file *filp,
 }
 
 int i830_getage(struct inode *inode, struct file *filp, unsigned int cmd,
-		unsigned long arg)
+		unsigned long __user arg)
 {
    	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1476,7 +1477,7 @@ int i830_getage(struct inode *inode, struct file *filp, unsigned int cmd,
 }
 
 int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
-		unsigned long arg)
+		unsigned long __user arg)
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1488,7 +1489,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
      					dev_priv->sarea_priv; 
 
 	DRM_DEBUG("getbuf\n");
-   	if (copy_from_user(&d, (drm_i830_dma_t *)arg, sizeof(d)))
+   	if (copy_from_user(&d, (drm_i830_dma_t __user *)arg, sizeof(d)))
 		return -EFAULT;
    
 	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
@@ -1503,7 +1504,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
 	DRM_DEBUG("i830_dma: %d returning %d, granted = %d\n",
 		  current->pid, retcode, d.granted);
 
-	if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d)))
+	if (copy_to_user((drm_dma_t __user *)arg, &d, sizeof(d)))
 		return -EFAULT;
    	sarea_priv->last_dispatch = (int) hw_status[5];
 
@@ -1513,7 +1514,7 @@ int i830_getbuf(struct inode *inode, struct file *filp, unsigned int cmd,
 int i830_copybuf(struct inode *inode,
 		 struct file *filp, 
 		 unsigned int cmd,
-		 unsigned long arg)
+		 unsigned long __user arg)
 {
 	/* Never copy - 2.4.x doesn't need it */
 	return 0;
@@ -1528,7 +1529,7 @@ int i830_docopy(struct inode *inode, struct file *filp, unsigned int cmd,
 
 
 int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
-		      unsigned long arg )
+		      unsigned long __user arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1541,7 +1542,7 @@ int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
 		return -EINVAL;
 	}
 
-	if (copy_from_user(&param, (drm_i830_getparam_t *)arg, sizeof(param) ))
+	if (copy_from_user(&param, (drm_i830_getparam_t __user *)arg, sizeof(param) ))
 		return -EFAULT;
 
 	switch( param.param ) {
@@ -1562,7 +1563,7 @@ int i830_getparam( struct inode *inode, struct file *filp, unsigned int cmd,
 
 
 int i830_setparam( struct inode *inode, struct file *filp, unsigned int cmd,
-		   unsigned long arg )
+		   unsigned long __user arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;
@@ -1574,7 +1575,7 @@ int i830_setparam( struct inode *inode, struct file *filp, unsigned int cmd,
 		return -EINVAL;
 	}
 
-	if (copy_from_user(&param, (drm_i830_setparam_t *)arg, sizeof(param) ))
+	if (copy_from_user(&param, (drm_i830_setparam_t __user *)arg, sizeof(param) ))
 		return -EFAULT;
 
 	switch( param.param ) {
diff --git a/linux/i830_drm.h b/linux/i830_drm.h
index b87c3371..1bd45994 100644
--- a/linux/i830_drm.h
+++ b/linux/i830_drm.h
@@ -290,11 +290,11 @@ typedef struct _drm_i830_vertex {
 typedef struct _drm_i830_copy_t {
    	int idx;		/* buffer index */
 	int used;		/* nr bytes in use */
-	void *address;		/* Address to copy from */
+	void __user *address;		/* Address to copy from */
 } drm_i830_copy_t;
 
 typedef struct drm_i830_dma {
-	void *virtual;
+	void __user *virtual;
 	int request_idx;
 	int request_size;
 	int granted;
@@ -304,7 +304,7 @@ typedef struct drm_i830_dma {
 /* 1.3: Userspace can request & wait on irq's:
  */
 typedef struct drm_i830_irq_emit {
-	int *irq_seq;
+	int __user *irq_seq;
 } drm_i830_irq_emit_t;
 
 typedef struct drm_i830_irq_wait {
@@ -318,7 +318,7 @@ typedef struct drm_i830_irq_wait {
 
 typedef struct drm_i830_getparam {
 	int param;
-	int *value;
+	int __user *value;
 } drm_i830_getparam_t;
 
 
diff --git a/linux/i830_drv.h b/linux/i830_drv.h
index b611c133..c6d805fc 100644
--- a/linux/i830_drv.h
+++ b/linux/i830_drv.h
@@ -36,7 +36,7 @@ typedef struct drm_i830_buf_priv {
    	u32 *in_use;
    	int my_use_idx;
 	int currently_mapped;
-	void *virtual;
+	void __user *virtual;
 	void *kernel_virtual;
 } drm_i830_buf_priv_t;
 
diff --git a/linux/i830_irq.c b/linux/i830_irq.c
index ae27f3bd..fcf2dedd 100644
--- a/linux/i830_irq.c
+++ b/linux/i830_irq.c
@@ -122,7 +122,7 @@ int i830_wait_irq(drm_device_t *dev, int irq_nr)
 /* Needs the lock as it touches the ring.
  */
 int i830_irq_emit( struct inode *inode, struct file *filp, unsigned int cmd,
-		   unsigned long arg )
+		   unsigned long __user arg )
 {
 	drm_file_t	  *priv	    = filp->private_data;
 	drm_device_t	  *dev	    = priv->dev;