1 files changed, 99 insertions, 101 deletions

diff --git a/drivers/char/drm/savage_state.c b/drivers/char/drm/savage_state.c
index 77497841478a..bf8e0e10fe21 100644
--- a/drivers/char/drm/savage_state.c
+++ b/drivers/char/drm/savage_state.c
@@ -83,7 +83,7 @@ static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit,
 {
         if ((addr & 6) != 2) {  /* reserved bits */
                 DRM_ERROR("bad texAddr%d %08x (reserved bits)\n", unit, addr);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
         if (!(addr & 1)) {      /* local */
                 addr &= ~7;
@@ -92,13 +92,13 @@ static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit,
                         DRM_ERROR
                             ("bad texAddr%d %08x (local addr out of range)\n",
                              unit, addr);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
         } else {                /* AGP */
                 if (!dev_priv->agp_textures) {
                         DRM_ERROR("bad texAddr%d %08x (AGP not available)\n",
                                   unit, addr);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 addr &= ~7;
                 if (addr < dev_priv->agp_textures->offset ||
@@ -107,7 +107,7 @@ static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit,
                         DRM_ERROR
                             ("bad texAddr%d %08x (AGP addr out of range)\n",
                              unit, addr);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
         }
         return 0;
@@ -133,7 +133,7 @@ static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
             start + count - 1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
                 DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
                           start, start + count - 1);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         SAVE_STATE_MASK(SAVAGE_SCSTART_S3D, s3d.new_scstart,
@@ -165,7 +165,7 @@ static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
             start + count - 1 > SAVAGE_TEXBLENDCOLOR_S4) {
                 DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
                           start, start + count - 1);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         SAVE_STATE_MASK(SAVAGE_DRAWCTRL0_S4, s4.new_drawctrl0,
@@ -289,7 +289,7 @@ static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
 
         if (!dmabuf) {
                 DRM_ERROR("called without dma buffers!\n");
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (!n)
@@ -303,7 +303,7 @@ static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
                 if (n % 3 != 0) {
                         DRM_ERROR("wrong number of vertices %u in TRILIST\n",
                                   n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         case SAVAGE_PRIM_TRISTRIP:
@@ -312,18 +312,18 @@ static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
                         DRM_ERROR
                             ("wrong number of vertices %u in TRIFAN/STRIP\n",
                              n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         default:
                 DRM_ERROR("invalid primitive type %u\n", prim);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                 if (skip != 0) {
                         DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
         } else {
                 unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
@@ -331,18 +331,18 @@ static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
                     (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
                 if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
                         DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 if (reorder) {
                         DRM_ERROR("TRILIST_201 used on Savage4 hardware\n");
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
         }
 
         if (start + n > dmabuf->total / 32) {
                 DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
                           start, start + n - 1, dmabuf->total / 32);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         /* Vertex DMA doesn't work with command DMA at the same time,
@@ -440,7 +440,7 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
                 if (n % 3 != 0) {
                         DRM_ERROR("wrong number of vertices %u in TRILIST\n",
                                   n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         case SAVAGE_PRIM_TRISTRIP:
@@ -449,24 +449,24 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
                         DRM_ERROR
                             ("wrong number of vertices %u in TRIFAN/STRIP\n",
                              n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         default:
                 DRM_ERROR("invalid primitive type %u\n", prim);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                 if (skip > SAVAGE_SKIP_ALL_S3D) {
                         DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 vtx_size = 8;   /* full vertex */
         } else {
                 if (skip > SAVAGE_SKIP_ALL_S4) {
                         DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 vtx_size = 10;  /* full vertex */
         }
@@ -478,13 +478,13 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
         if (vtx_size > vb_stride) {
                 DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
                           vtx_size, vb_stride);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (start + n > vb_size / (vb_stride * 4)) {
                 DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
                           start, start + n - 1, vb_size / (vb_stride * 4));
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         prim <<= 25;
@@ -547,7 +547,7 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
 
         if (!dmabuf) {
                 DRM_ERROR("called without dma buffers!\n");
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (!n)
@@ -560,7 +560,7 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
         case SAVAGE_PRIM_TRILIST:
                 if (n % 3 != 0) {
                         DRM_ERROR("wrong number of indices %u in TRILIST\n", n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         case SAVAGE_PRIM_TRISTRIP:
@@ -568,18 +568,18 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
                 if (n < 3) {
                         DRM_ERROR
                             ("wrong number of indices %u in TRIFAN/STRIP\n", n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         default:
                 DRM_ERROR("invalid primitive type %u\n", prim);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                 if (skip != 0) {
                         DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
         } else {
                 unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
@@ -587,11 +587,11 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
                     (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
                 if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
                         DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 if (reorder) {
                         DRM_ERROR("TRILIST_201 used on Savage4 hardware\n");
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
         }
 
@@ -628,7 +628,7 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
                         if (idx[i] > dmabuf->total / 32) {
                                 DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
                                           i, idx[i], dmabuf->total / 32);
-                                return DRM_ERR(EINVAL);
+                                return -EINVAL;
                         }
                 }
 
@@ -698,7 +698,7 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
         case SAVAGE_PRIM_TRILIST:
                 if (n % 3 != 0) {
                         DRM_ERROR("wrong number of indices %u in TRILIST\n", n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         case SAVAGE_PRIM_TRISTRIP:
@@ -706,24 +706,24 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
                 if (n < 3) {
                         DRM_ERROR
                             ("wrong number of indices %u in TRIFAN/STRIP\n", n);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 break;
         default:
                 DRM_ERROR("invalid primitive type %u\n", prim);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                 if (skip > SAVAGE_SKIP_ALL_S3D) {
                         DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 vtx_size = 8;   /* full vertex */
         } else {
                 if (skip > SAVAGE_SKIP_ALL_S4) {
                         DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-                        return DRM_ERR(EINVAL);
+                        return -EINVAL;
                 }
                 vtx_size = 10;  /* full vertex */
         }
@@ -735,7 +735,7 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
         if (vtx_size > vb_stride) {
                 DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
                           vtx_size, vb_stride);
-                return DRM_ERR(EINVAL);
+                return -EINVAL;
         }
 
         prim <<= 25;
@@ -748,7 +748,7 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
                         if (idx[i] > vb_size / (vb_stride * 4)) {
                                 DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
                                           i, idx[i], vb_size / (vb_stride * 4));
-                                return DRM_ERR(EINVAL);
+                                return -EINVAL;
                         }
                 }
 
@@ -942,7 +942,7 @@ static int savage_dispatch_draw(drm_savage_private_t * dev_priv,
                                 DRM_ERROR("IMPLEMENTATION ERROR: "
                                           "non-drawing-command %d\n",
                                           cmd_header.cmd.cmd);
-                                return DRM_ERR(EINVAL);
+                                return -EINVAL;
                         }
 
                         if (ret != 0)
@@ -953,13 +953,12 @@ static int savage_dispatch_draw(drm_savage_private_t * dev_priv,
         return 0;
 }
 
-int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
+int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_priv)
 {
-        DRM_DEVICE;
         drm_savage_private_t *dev_priv = dev->dev_private;
         struct drm_device_dma *dma = dev->dma;
         struct drm_buf *dmabuf;
-        drm_savage_cmdbuf_t cmdbuf;
+        drm_savage_cmdbuf_t *cmdbuf = data;
         drm_savage_cmd_header_t *kcmd_addr = NULL;
         drm_savage_cmd_header_t *first_draw_cmd;
         unsigned int *kvb_addr = NULL;
@@ -969,19 +968,16 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
 
         DRM_DEBUG("\n");
 
-        LOCK_TEST_WITH_RETURN(dev, filp);
-
-        DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *) data,
-                                 sizeof(cmdbuf));
+        LOCK_TEST_WITH_RETURN(dev, file_priv);
 
         if (dma && dma->buflist) {
-                if (cmdbuf.dma_idx > dma->buf_count) {
+                if (cmdbuf->dma_idx > dma->buf_count) {
                         DRM_ERROR
                             ("vertex buffer index %u out of range (0-%u)\n",
-                             cmdbuf.dma_idx, dma->buf_count - 1);
-                        return DRM_ERR(EINVAL);
+                             cmdbuf->dma_idx, dma->buf_count - 1);
+                        return -EINVAL;
                 }
-                dmabuf = dma->buflist[cmdbuf.dma_idx];
+                dmabuf = dma->buflist[cmdbuf->dma_idx];
         } else {
                 dmabuf = NULL;
         }
@@ -991,47 +987,47 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
          * COPY_FROM_USER_UNCHECKED when done in other drivers, and is correct
          * for locking on FreeBSD.
          */
-        if (cmdbuf.size) {
-                kcmd_addr = drm_alloc(cmdbuf.size * 8, DRM_MEM_DRIVER);
+        if (cmdbuf->size) {
+                kcmd_addr = drm_alloc(cmdbuf->size * 8, DRM_MEM_DRIVER);
                 if (kcmd_addr == NULL)
-                        return DRM_ERR(ENOMEM);
+                        return -ENOMEM;
 
-                if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf.cmd_addr,
-                                       cmdbuf.size * 8))
+                if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf->cmd_addr,
+                                       cmdbuf->size * 8))
                 {
-                        drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
-                        return DRM_ERR(EFAULT);
+                        drm_free(kcmd_addr, cmdbuf->size * 8, DRM_MEM_DRIVER);
+                        return -EFAULT;
                 }
-                cmdbuf.cmd_addr = kcmd_addr;
+                cmdbuf->cmd_addr = kcmd_addr;
         }
-        if (cmdbuf.vb_size) {
-                kvb_addr = drm_alloc(cmdbuf.vb_size, DRM_MEM_DRIVER);
+        if (cmdbuf->vb_size) {
+                kvb_addr = drm_alloc(cmdbuf->vb_size, DRM_MEM_DRIVER);
                 if (kvb_addr == NULL) {
-                        ret = DRM_ERR(ENOMEM);
+                        ret = -ENOMEM;
                         goto done;
                 }
 
-                if (DRM_COPY_FROM_USER(kvb_addr, cmdbuf.vb_addr,
-                                       cmdbuf.vb_size)) {
-                        ret = DRM_ERR(EFAULT);
+                if (DRM_COPY_FROM_USER(kvb_addr, cmdbuf->vb_addr,
+                                       cmdbuf->vb_size)) {
+                        ret = -EFAULT;
                         goto done;
                 }
-                cmdbuf.vb_addr = kvb_addr;
+                cmdbuf->vb_addr = kvb_addr;
         }
-        if (cmdbuf.nbox) {
-                kbox_addr = drm_alloc(cmdbuf.nbox * sizeof(struct drm_clip_rect),
+        if (cmdbuf->nbox) {
+                kbox_addr = drm_alloc(cmdbuf->nbox * sizeof(struct drm_clip_rect),
                                        DRM_MEM_DRIVER);
                 if (kbox_addr == NULL) {
-                        ret = DRM_ERR(ENOMEM);
+                        ret = -ENOMEM;
                         goto done;
                 }
 
-                if (DRM_COPY_FROM_USER(kbox_addr, cmdbuf.box_addr,
-                                       cmdbuf.nbox * sizeof(struct drm_clip_rect))) {
-                        ret = DRM_ERR(EFAULT);
+                if (DRM_COPY_FROM_USER(kbox_addr, cmdbuf->box_addr,
+                                       cmdbuf->nbox * sizeof(struct drm_clip_rect))) {
+                        ret = -EFAULT;
                         goto done;
                 }
-        cmdbuf.box_addr = kbox_addr;
+        cmdbuf->box_addr = kbox_addr;
         }
 
         /* Make sure writes to DMA buffers are finished before sending
@@ -1044,10 +1040,10 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
 
         i = 0;
         first_draw_cmd = NULL;
-        while (i < cmdbuf.size) {
+        while (i < cmdbuf->size) {
                 drm_savage_cmd_header_t cmd_header;
-                cmd_header = *(drm_savage_cmd_header_t *)cmdbuf.cmd_addr;
-                cmdbuf.cmd_addr++;
+                cmd_header = *(drm_savage_cmd_header_t *)cmdbuf->cmd_addr;
+                cmdbuf->cmd_addr++;
                 i++;
 
                 /* Group drawing commands with same state to minimize
@@ -1057,28 +1053,28 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                 case SAVAGE_CMD_DMA_IDX:
                 case SAVAGE_CMD_VB_IDX:
                         j = (cmd_header.idx.count + 3) / 4;
-                        if (i + j > cmdbuf.size) {
+                        if (i + j > cmdbuf->size) {
                                 DRM_ERROR("indexed drawing command extends "
                                           "beyond end of command buffer\n");
                                 DMA_FLUSH();
-                                return DRM_ERR(EINVAL);
+                                return -EINVAL;
                         }
                         /* fall through */
                 case SAVAGE_CMD_DMA_PRIM:
                 case SAVAGE_CMD_VB_PRIM:
                         if (!first_draw_cmd)
-                                first_draw_cmd = cmdbuf.cmd_addr - 1;
-                        cmdbuf.cmd_addr += j;
+                                first_draw_cmd = cmdbuf->cmd_addr - 1;
+                        cmdbuf->cmd_addr += j;
                         i += j;
                         break;
                 default:
                         if (first_draw_cmd) {
                                 ret = savage_dispatch_draw(
                                       dev_priv, first_draw_cmd,
-                                      cmdbuf.cmd_addr - 1,
-                                      dmabuf, cmdbuf.vb_addr, cmdbuf.vb_size,
-                                      cmdbuf.vb_stride,
-                                      cmdbuf.nbox, cmdbuf.box_addr);
+                                      cmdbuf->cmd_addr - 1,
+                                      dmabuf, cmdbuf->vb_addr, cmdbuf->vb_size,
+                                      cmdbuf->vb_stride,
+                                      cmdbuf->nbox, cmdbuf->box_addr);
                                 if (ret != 0)
                                         return ret;
                                 first_draw_cmd = NULL;
@@ -1090,40 +1086,42 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                 switch (cmd_header.cmd.cmd) {
                 case SAVAGE_CMD_STATE:
                         j = (cmd_header.state.count + 1) / 2;
-                        if (i + j > cmdbuf.size) {
+                        if (i + j > cmdbuf->size) {
                                 DRM_ERROR("command SAVAGE_CMD_STATE extends "
                                           "beyond end of command buffer\n");
                                 DMA_FLUSH();
-                                ret = DRM_ERR(EINVAL);
+                                ret = -EINVAL;
                                 goto done;
                         }
                         ret = savage_dispatch_state(dev_priv, &cmd_header,
-                                (const uint32_t *)cmdbuf.cmd_addr);
-                        cmdbuf.cmd_addr += j;
+                                (const uint32_t *)cmdbuf->cmd_addr);
+                        cmdbuf->cmd_addr += j;
                         i += j;
                         break;
                 case SAVAGE_CMD_CLEAR:
-                        if (i + 1 > cmdbuf.size) {
+                        if (i + 1 > cmdbuf->size) {
                                 DRM_ERROR("command SAVAGE_CMD_CLEAR extends "
                                           "beyond end of command buffer\n");
                                 DMA_FLUSH();
-                                ret = DRM_ERR(EINVAL);
+                                ret = -EINVAL;
                                 goto done;
                         }
                         ret = savage_dispatch_clear(dev_priv, &cmd_header,
-                                                    cmdbuf.cmd_addr,
-                                                    cmdbuf.nbox, cmdbuf.box_addr);
-                        cmdbuf.cmd_addr++;
+                                                    cmdbuf->cmd_addr,
+                                                    cmdbuf->nbox,
+                                                    cmdbuf->box_addr);
+                        cmdbuf->cmd_addr++;
                         i++;
                         break;
                 case SAVAGE_CMD_SWAP:
-                        ret = savage_dispatch_swap(dev_priv, cmdbuf.nbox,
-                                                   cmdbuf.box_addr);
+                        ret = savage_dispatch_swap(dev_priv, cmdbuf->nbox,
+                                                   cmdbuf->box_addr);
                         break;
                 default:
-                        DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd);
+                        DRM_ERROR("invalid command 0x%x\n",
+                                  cmd_header.cmd.cmd);
                         DMA_FLUSH();
-                        ret = DRM_ERR(EINVAL);
+                        ret = -EINVAL;
                         goto done;
                 }
 
@@ -1135,9 +1133,9 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
 
         if (first_draw_cmd) {
                 ret = savage_dispatch_draw (
-                        dev_priv, first_draw_cmd, cmdbuf.cmd_addr, dmabuf,
-                        cmdbuf.vb_addr, cmdbuf.vb_size, cmdbuf.vb_stride,
-                        cmdbuf.nbox, cmdbuf.box_addr);
+                        dev_priv, first_draw_cmd, cmdbuf->cmd_addr, dmabuf,
+                        cmdbuf->vb_addr, cmdbuf->vb_size, cmdbuf->vb_stride,
+                        cmdbuf->nbox, cmdbuf->box_addr);
                 if (ret != 0) {
                         DMA_FLUSH();
                         goto done;
@@ -1146,7 +1144,7 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
 
         DMA_FLUSH();
 
-        if (dmabuf && cmdbuf.discard) {
+        if (dmabuf && cmdbuf->discard) {
                 drm_savage_buf_priv_t *buf_priv = dmabuf->dev_private;
                 uint16_t event;
                 event = savage_bci_emit_event(dev_priv, SAVAGE_WAIT_3D);
@@ -1156,9 +1154,9 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
 
 done:
         /* If we didn't need to allocate them, these'll be NULL */
-        drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
-        drm_free(kvb_addr, cmdbuf.vb_size, DRM_MEM_DRIVER);
-        drm_free(kbox_addr, cmdbuf.nbox * sizeof(struct drm_clip_rect),
+        drm_free(kcmd_addr, cmdbuf->size * 8, DRM_MEM_DRIVER);
+        drm_free(kvb_addr, cmdbuf->vb_size, DRM_MEM_DRIVER);
+        drm_free(kbox_addr, cmdbuf->nbox * sizeof(struct drm_clip_rect),
                  DRM_MEM_DRIVER);
 
         return ret;