1 files changed, 44 insertions, 82 deletions

diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 7c20dc344b99..eb3cf550626d 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -362,25 +362,19 @@ static void drm_cleanup_buf_error(drm_device_t *dev, drm_buf_entry_t *entry)
 
 #if __OS_HAS_AGP
 /**
- * Add AGP buffers for DMA transfers (ioctl).
+ * Add AGP buffers for DMA transfers.
  *
- * \param inode device inode.
- * \param filp file pointer.
- * \param cmd command.
- * \param arg pointer to a drm_buf_desc_t request.
+ * \param dev drm_device_t to which the buffers are to be added.
+ * \param request pointer to a drm_buf_desc_t describing the request.
  * \return zero on success or a negative number on failure.
  * 
  * After some sanity checks creates a drm_buf structure for each buffer and
  * reallocates the buffer list of the same size order to accommodate the new
  * buffers.
  */
-static int drm_addbufs_agp( struct inode *inode, struct file *filp,
-                            unsigned int cmd, unsigned long arg )
+static int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t request;
         drm_buf_entry_t *entry;
         drm_buf_t *buf;
         unsigned long offset;
@@ -394,25 +388,20 @@ static int drm_addbufs_agp( struct inode *inode, struct file *filp,
         int byte_count;
         int i;
         drm_buf_t **temp_buflist;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
 
         if ( !dma ) return -EINVAL;
 
-        if ( copy_from_user( &request, argp,
-                             sizeof(request) ) )
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order( request.size );
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
-        alignment  = (request.flags & _DRM_PAGE_ALIGN)
+        alignment  = (request->flags & _DRM_PAGE_ALIGN)
                 ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
 
         byte_count = 0;
-        agp_offset = dev->agp->base + request.agp_start;
+        agp_offset = dev->agp->base + request->agp_start;
 
         DRM_DEBUG( "count:      %d\n",  count );
         DRM_DEBUG( "order:      %d\n",  order );
@@ -526,11 +515,8 @@ static int drm_addbufs_agp( struct inode *inode, struct file *filp,
 
         up( &dev->struct_sem );
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if ( copy_to_user( argp, &request, sizeof(request) ) )
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         dma->flags = _DRM_DMA_USE_AGP;
 
@@ -539,13 +525,9 @@ static int drm_addbufs_agp( struct inode *inode, struct file *filp,
 }
 #endif /* __OS_HAS_AGP */
 
-static int drm_addbufs_pci( struct inode *inode, struct file *filp,
-                            unsigned int cmd, unsigned long arg )
+static int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t request;
         int count;
         int order;
         int size;
@@ -561,26 +543,22 @@ static int drm_addbufs_pci( struct inode *inode, struct file *filp,
         int page_count;
         unsigned long *temp_pagelist;
         drm_buf_t **temp_buflist;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
 
         if (!drm_core_check_feature(dev, DRIVER_PCI_DMA)) return -EINVAL;
         if ( !dma ) return -EINVAL;
 
-        if ( copy_from_user( &request, argp, sizeof(request) ) )
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order( request.size );
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
         DRM_DEBUG( "count=%d, size=%d (%d), order=%d, queue_count=%d\n",
-                   request.count, request.size, size,
+                   request->count, request->size, size,
                    order, dev->queue_count );
 
         if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
         if ( dev->queue_count ) return -EBUSY; /* Not while in use */
 
-        alignment = (request.flags & _DRM_PAGE_ALIGN)
+        alignment = (request->flags & _DRM_PAGE_ALIGN)
                 ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
@@ -758,25 +736,17 @@ static int drm_addbufs_pci( struct inode *inode, struct file *filp,
 
         up( &dev->struct_sem );
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if ( copy_to_user( argp, &request, sizeof(request) ) )
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         atomic_dec( &dev->buf_alloc );
         return 0;
 
 }
 
-static int drm_addbufs_sg( struct inode *inode, struct file *filp,
-                           unsigned int cmd, unsigned long arg )
+static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
-        drm_buf_desc_t request;
         drm_buf_entry_t *entry;
         drm_buf_t *buf;
         unsigned long offset;
@@ -795,20 +765,17 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
         
         if ( !dma ) return -EINVAL;
 
-        if ( copy_from_user( &request, argp, sizeof(request) ) )
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order( request.size );
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
-        alignment  = (request.flags & _DRM_PAGE_ALIGN)
+        alignment  = (request->flags & _DRM_PAGE_ALIGN)
                         ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
 
         byte_count = 0;
-        agp_offset = request.agp_start;
+        agp_offset = request->agp_start;
 
         DRM_DEBUG( "count:      %d\n",  count );
         DRM_DEBUG( "order:      %d\n",  order );
@@ -923,11 +890,8 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
 
         up( &dev->struct_sem );
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if ( copy_to_user( argp, &request, sizeof(request) ) )
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         dma->flags = _DRM_DMA_USE_SG;
 
@@ -935,13 +899,9 @@ static int drm_addbufs_sg( struct inode *inode, struct file *filp,
         return 0;
 }
 
-int drm_addbufs_fb(struct inode *inode, struct file *filp,
-                    unsigned int cmd, unsigned long arg)
+int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
         drm_device_dma_t *dma = dev->dma;
-        drm_buf_desc_t request;
         drm_buf_entry_t *entry;
         drm_buf_t *buf;
         unsigned long offset;
@@ -955,7 +915,6 @@ int drm_addbufs_fb(struct inode *inode, struct file *filp,
         int byte_count;
         int i;
         drm_buf_t **temp_buflist;
-        drm_buf_desc_t __user *argp = (void __user *)arg;
 
         if (!drm_core_check_feature(dev, DRIVER_FB_DMA))
                 return -EINVAL;
@@ -963,20 +922,17 @@ int drm_addbufs_fb(struct inode *inode, struct file *filp,
         if (!dma)
                 return -EINVAL;
 
-        if (copy_from_user(&request, argp, sizeof(request)))
-                return -EFAULT;
-
-        count = request.count;
-        order = drm_order(request.size);
+        count = request->count;
+        order = drm_order(request->size);
         size = 1 << order;
 
-        alignment = (request.flags & _DRM_PAGE_ALIGN)
+        alignment = (request->flags & _DRM_PAGE_ALIGN)
             ? PAGE_ALIGN(size) : size;
         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
         total = PAGE_SIZE << page_order;
 
         byte_count = 0;
-        agp_offset = request.agp_start;
+        agp_offset = request->agp_start;
 
         DRM_DEBUG("count:      %d\n", count);
         DRM_DEBUG("order:      %d\n", order);
@@ -1089,11 +1045,8 @@ int drm_addbufs_fb(struct inode *inode, struct file *filp,
 
         up(&dev->struct_sem);
 
-        request.count = entry->buf_count;
-        request.size = size;
-
-        if (copy_to_user(argp, &request, sizeof(request)))
-                return -EFAULT;
+        request->count = entry->buf_count;
+        request->size = size;
 
         dma->flags = _DRM_DMA_USE_FB;
 
@@ -1121,6 +1074,7 @@ int drm_addbufs( struct inode *inode, struct file *filp,
         drm_buf_desc_t request;
         drm_file_t *priv = filp->private_data;
         drm_device_t *dev = priv->head->dev;
+        int ret;
         
         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
                 return -EINVAL;
@@ -1131,15 +1085,23 @@ int drm_addbufs( struct inode *inode, struct file *filp,
 
 #if __OS_HAS_AGP
         if ( request.flags & _DRM_AGP_BUFFER )
-                return drm_addbufs_agp( inode, filp, cmd, arg );
+                ret=drm_addbufs_agp(dev, &request);
         else
 #endif
         if ( request.flags & _DRM_SG_BUFFER )
-                return drm_addbufs_sg( inode, filp, cmd, arg );
+                ret=drm_addbufs_sg(dev, &request);
         else if ( request.flags & _DRM_FB_BUFFER)
-                return drm_addbufs_fb( inode, filp, cmd, arg );
+                ret=drm_addbufs_fb(dev, &request);
         else
-                return drm_addbufs_pci( inode, filp, cmd, arg );
+                ret=drm_addbufs_pci(dev, &request);
+
+        if (ret==0) {
+                if (copy_to_user((void __user *)arg, &request,
+                                 sizeof(request))) {
+                        ret = -EFAULT;
+                }
+        }
+        return ret;
 }