Merge branch 'upstream' into max-sect
[pandora-kernel.git] / drivers / char / drm / savage_state.c
index 475695a..ef2581d 100644 (file)
 #include "savage_drm.h"
 #include "savage_drv.h"
 
-void savage_emit_clip_rect_s3d(drm_savage_private_t *dev_priv,
-                              drm_clip_rect_t *pbox)
+void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
+                              const drm_clip_rect_t * pbox)
 {
        uint32_t scstart = dev_priv->state.s3d.new_scstart;
-       uint32_t scend   = dev_priv->state.s3d.new_scend;
+       uint32_t scend = dev_priv->state.s3d.new_scend;
        scstart = (scstart & ~SAVAGE_SCISSOR_MASK_S3D) |
-               ((uint32_t)pbox->x1 & 0x000007ff) | 
-               (((uint32_t)pbox->y1 << 16) & 0x07ff0000);
-       scend   = (scend   & ~SAVAGE_SCISSOR_MASK_S3D) |
-               (((uint32_t)pbox->x2-1) & 0x000007ff) |
-               ((((uint32_t)pbox->y2-1) << 16) & 0x07ff0000);
+           ((uint32_t) pbox->x1 & 0x000007ff) |
+           (((uint32_t) pbox->y1 << 16) & 0x07ff0000);
+       scend = (scend & ~SAVAGE_SCISSOR_MASK_S3D) |
+           (((uint32_t) pbox->x2 - 1) & 0x000007ff) |
+           ((((uint32_t) pbox->y2 - 1) << 16) & 0x07ff0000);
        if (scstart != dev_priv->state.s3d.scstart ||
-           scend   != dev_priv->state.s3d.scend) {
+           scend != dev_priv->state.s3d.scend) {
                DMA_LOCALS;
                BEGIN_DMA(4);
-               DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D);
+               DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D);
                DMA_SET_REGISTERS(SAVAGE_SCSTART_S3D, 2);
                DMA_WRITE(scstart);
                DMA_WRITE(scend);
                dev_priv->state.s3d.scstart = scstart;
-               dev_priv->state.s3d.scend   = scend;
+               dev_priv->state.s3d.scend = scend;
                dev_priv->waiting = 1;
                DMA_COMMIT();
        }
 }
 
-void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv,
-                             drm_clip_rect_t *pbox)
+void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
+                             const drm_clip_rect_t * pbox)
 {
        uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0;
        uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1;
        drawctrl0 = (drawctrl0 & ~SAVAGE_SCISSOR_MASK_S4) |
-               ((uint32_t)pbox->x1 & 0x000007ff) |
-               (((uint32_t)pbox->y1 << 12) & 0x00fff000);
+           ((uint32_t) pbox->x1 & 0x000007ff) |
+           (((uint32_t) pbox->y1 << 12) & 0x00fff000);
        drawctrl1 = (drawctrl1 & ~SAVAGE_SCISSOR_MASK_S4) |
-               (((uint32_t)pbox->x2-1) & 0x000007ff) |
-               ((((uint32_t)pbox->y2-1) << 12) & 0x00fff000);
+           (((uint32_t) pbox->x2 - 1) & 0x000007ff) |
+           ((((uint32_t) pbox->y2 - 1) << 12) & 0x00fff000);
        if (drawctrl0 != dev_priv->state.s4.drawctrl0 ||
            drawctrl1 != dev_priv->state.s4.drawctrl1) {
                DMA_LOCALS;
                BEGIN_DMA(4);
-               DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D);
+               DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D);
                DMA_SET_REGISTERS(SAVAGE_DRAWCTRL0_S4, 2);
                DMA_WRITE(drawctrl0);
                DMA_WRITE(drawctrl1);
@@ -78,22 +78,23 @@ void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv,
        }
 }
 
-static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit,
+static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit,
                                 uint32_t addr)
 {
-       if ((addr & 6) != 2) { /* reserved bits */
+       if ((addr & 6) != 2) {  /* reserved bits */
                DRM_ERROR("bad texAddr%d %08x (reserved bits)\n", unit, addr);
                return DRM_ERR(EINVAL);
        }
-       if (!(addr & 1)) { /* local */
+       if (!(addr & 1)) {      /* local */
                addr &= ~7;
-               if (addr <  dev_priv->texture_offset ||
-                   addr >= dev_priv->texture_offset+dev_priv->texture_size) {
-                       DRM_ERROR("bad texAddr%d %08x (local addr out of range)\n",
-                                 unit, addr);
+               if (addr < dev_priv->texture_offset ||
+                   addr >= dev_priv->texture_offset + dev_priv->texture_size) {
+                       DRM_ERROR
+                           ("bad texAddr%d %08x (local addr out of range)\n",
+                            unit, addr);
                        return DRM_ERR(EINVAL);
                }
-       } else { /* AGP */
+       } else {                /* AGP */
                if (!dev_priv->agp_textures) {
                        DRM_ERROR("bad texAddr%d %08x (AGP not available)\n",
                                  unit, addr);
@@ -103,8 +104,9 @@ static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit,
                if (addr < dev_priv->agp_textures->offset ||
                    addr >= (dev_priv->agp_textures->offset +
                             dev_priv->agp_textures->size)) {
-                       DRM_ERROR("bad texAddr%d %08x (AGP addr out of range)\n",
-                                 unit, addr);
+                       DRM_ERROR
+                           ("bad texAddr%d %08x (AGP addr out of range)\n",
+                            unit, addr);
                        return DRM_ERR(EINVAL);
                }
        }
@@ -113,23 +115,24 @@ static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit,
 
 #define SAVE_STATE(reg,where)                  \
        if(start <= reg && start+count > reg)   \
-               DRM_GET_USER_UNCHECKED(dev_priv->state.where, &regs[reg-start])
+               dev_priv->state.where = regs[reg - start]
 #define SAVE_STATE_MASK(reg,where,mask) do {                   \
        if(start <= reg && start+count > reg) {                 \
                uint32_t tmp;                                   \
-               DRM_GET_USER_UNCHECKED(tmp, &regs[reg-start]);  \
+               tmp = regs[reg - start];                        \
                dev_priv->state.where = (tmp & (mask)) |        \
                        (dev_priv->state.where & ~(mask));      \
        }                                                       \
 } while (0)
-static int savage_verify_state_s3d(drm_savage_private_t *dev_priv,
+
+static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
                                   unsigned int start, unsigned int count,
-                                  const uint32_t __user *regs)
+                                  const uint32_t *regs)
 {
        if (start < SAVAGE_TEXPALADDR_S3D ||
-           start+count-1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
+           start + count - 1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
                DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
-                         start, start+count-1);
+                         start, start + count - 1);
                return DRM_ERR(EINVAL);
        }
 
@@ -140,28 +143,28 @@ static int savage_verify_state_s3d(drm_savage_private_t *dev_priv,
 
        /* if any texture regs were changed ... */
        if (start <= SAVAGE_TEXCTRL_S3D &&
-           start+count > SAVAGE_TEXPALADDR_S3D) {
+           start + count > SAVAGE_TEXPALADDR_S3D) {
                /* ... check texture state */
                SAVE_STATE(SAVAGE_TEXCTRL_S3D, s3d.texctrl);
                SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr);
                if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK)
-                       return savage_verify_texaddr(
-                               dev_priv, 0, dev_priv->state.s3d.texaddr);
+                       return savage_verify_texaddr(dev_priv, 0,
+                                               dev_priv->state.s3d.texaddr);
        }
 
        return 0;
 }
 
-static int savage_verify_state_s4(drm_savage_private_t *dev_priv,
+static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
                                  unsigned int start, unsigned int count,
-                                 const uint32_t __user *regs)
+                                 const uint32_t *regs)
 {
        int ret = 0;
 
        if (start < SAVAGE_DRAWLOCALCTRL_S4 ||
-           start+count-1 > SAVAGE_TEXBLENDCOLOR_S4) {
+           start + count - 1 > SAVAGE_TEXBLENDCOLOR_S4) {
                DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
-                         start, start+count-1);
+                         start, start + count - 1);
                return DRM_ERR(EINVAL);
        }
 
@@ -172,27 +175,28 @@ static int savage_verify_state_s4(drm_savage_private_t *dev_priv,
 
        /* if any texture regs were changed ... */
        if (start <= SAVAGE_TEXDESCR_S4 &&
-           start+count > SAVAGE_TEXPALADDR_S4) {
+           start + count > SAVAGE_TEXPALADDR_S4) {
                /* ... check texture state */
                SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr);
                SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0);
                SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1);
                if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK)
-                       ret |= savage_verify_texaddr(
-                               dev_priv, 0, dev_priv->state.s4.texaddr0);
+                       ret |= savage_verify_texaddr(dev_priv, 0,
+                                               dev_priv->state.s4.texaddr0);
                if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK)
-                       ret |= savage_verify_texaddr(
-                               dev_priv, 1, dev_priv->state.s4.texaddr1);
+                       ret |= savage_verify_texaddr(dev_priv, 1,
+                                               dev_priv->state.s4.texaddr1);
        }
 
        return ret;
 }
+
 #undef SAVE_STATE
 #undef SAVE_STATE_MASK
 
-static int savage_dispatch_state(drm_savage_private_t *dev_priv,
-                                const drm_savage_cmd_header_t *cmd_header,
-                                const uint32_t __user *regs)
+static int savage_dispatch_state(drm_savage_private_t * dev_priv,
+                                const drm_savage_cmd_header_t * cmd_header,
+                                const uint32_t *regs)
 {
        unsigned int count = cmd_header->state.count;
        unsigned int start = cmd_header->state.start;
@@ -204,23 +208,20 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv,
        if (!count)
                return 0;
 
-       if (DRM_VERIFYAREA_READ(regs, count*4))
-               return DRM_ERR(EFAULT);
-
        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                ret = savage_verify_state_s3d(dev_priv, start, count, regs);
                if (ret != 0)
                        return ret;
                /* scissor regs are emitted in savage_dispatch_draw */
                if (start < SAVAGE_SCSTART_S3D) {
-                       if (start+count > SAVAGE_SCEND_S3D+1)
-                               count2 = count - (SAVAGE_SCEND_S3D+1 - start);
-                       if (start+count > SAVAGE_SCSTART_S3D)
+                       if (start + count > SAVAGE_SCEND_S3D + 1)
+                               count2 = count - (SAVAGE_SCEND_S3D + 1 - start);
+                       if (start + count > SAVAGE_SCSTART_S3D)
                                count = SAVAGE_SCSTART_S3D - start;
                } else if (start <= SAVAGE_SCEND_S3D) {
-                       if (start+count > SAVAGE_SCEND_S3D+1) {
-                               count -= SAVAGE_SCEND_S3D+1 - start;
-                               start = SAVAGE_SCEND_S3D+1;
+                       if (start + count > SAVAGE_SCEND_S3D + 1) {
+                               count -= SAVAGE_SCEND_S3D + 1 - start;
+                               start = SAVAGE_SCEND_S3D + 1;
                        } else
                                return 0;
                }
@@ -230,23 +231,24 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv,
                        return ret;
                /* scissor regs are emitted in savage_dispatch_draw */
                if (start < SAVAGE_DRAWCTRL0_S4) {
-                       if (start+count > SAVAGE_DRAWCTRL1_S4+1)
-                               count2 = count - (SAVAGE_DRAWCTRL1_S4+1 - start);
-                       if (start+count > SAVAGE_DRAWCTRL0_S4)
+                       if (start + count > SAVAGE_DRAWCTRL1_S4 + 1)
+                               count2 = count -
+                                        (SAVAGE_DRAWCTRL1_S4 + 1 - start);
+                       if (start + count > SAVAGE_DRAWCTRL0_S4)
                                count = SAVAGE_DRAWCTRL0_S4 - start;
                } else if (start <= SAVAGE_DRAWCTRL1_S4) {
-                       if (start+count > SAVAGE_DRAWCTRL1_S4+1) {
-                               count -= SAVAGE_DRAWCTRL1_S4+1 - start;
-                               start = SAVAGE_DRAWCTRL1_S4+1;
+                       if (start + count > SAVAGE_DRAWCTRL1_S4 + 1) {
+                               count -= SAVAGE_DRAWCTRL1_S4 + 1 - start;
+                               start = SAVAGE_DRAWCTRL1_S4 + 1;
                        } else
                                return 0;
                }
        }
 
-       bci_size = count + (count+254)/255 + count2 + (count2+254)/255;
+       bci_size = count + (count + 254) / 255 + count2 + (count2 + 254) / 255;
 
        if (cmd_header->state.global) {
-               BEGIN_DMA(bci_size+1);
+               BEGIN_DMA(bci_size + 1);
                DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D);
                dev_priv->waiting = 1;
        } else {
@@ -257,7 +259,7 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv,
                while (count > 0) {
                        unsigned int n = count < 255 ? count : 255;
                        DMA_SET_REGISTERS(start, n);
-                       DMA_COPY_FROM_USER(regs, n);
+                       DMA_COPY(regs, n);
                        count -= n;
                        start += n;
                        regs += n;
@@ -273,9 +275,9 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv,
        return 0;
 }
 
-static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
-                                   const drm_savage_cmd_header_t *cmd_header,
-                                   const drm_buf_t *dmabuf)
+static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
+                                   const drm_savage_cmd_header_t * cmd_header,
+                                   const drm_buf_t * dmabuf)
 {
        unsigned char reorder = 0;
        unsigned int prim = cmd_header->prim.prim;
@@ -286,8 +288,8 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
        BCI_LOCALS;
 
        if (!dmabuf) {
-           DRM_ERROR("called without dma buffers!\n");
-           return DRM_ERR(EINVAL);
+               DRM_ERROR("called without dma buffers!\n");
+               return DRM_ERR(EINVAL);
        }
 
        if (!n)
@@ -307,8 +309,9 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
        case SAVAGE_PRIM_TRISTRIP:
        case SAVAGE_PRIM_TRIFAN:
                if (n < 3) {
-                       DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n",
-                                 n);
+                       DRM_ERROR
+                           ("wrong number of vertices %u in TRIFAN/STRIP\n",
+                            n);
                        return DRM_ERR(EINVAL);
                }
                break;
@@ -319,17 +322,15 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
 
        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                if (skip != 0) {
-                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-                                 skip);
+                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
                        return DRM_ERR(EINVAL);
                }
        } else {
                unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
-                       (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
-                       (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
+                   (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
+                   (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
                if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
-                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-                                 skip);
+                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
                        return DRM_ERR(EINVAL);
                }
                if (reorder) {
@@ -338,9 +339,9 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
                }
        }
 
-       if (start + n > dmabuf->total/32) {
+       if (start + n > dmabuf->total / 32) {
                DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
-                         start, start + n - 1, dmabuf->total/32);
+                         start, start + n - 1, dmabuf->total / 32);
                return DRM_ERR(EINVAL);
        }
 
@@ -375,32 +376,33 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
                        /* Need to reorder indices for correct flat
                         * shading while preserving the clock sense
                         * for correct culling. Only on Savage3D. */
-                       int reorder[3] = {-1, -1, -1};
-                       reorder[start%3] = 2;
+                       int reorder[3] = { -1, -1, -1 };
+                       reorder[start % 3] = 2;
 
-                       BEGIN_BCI((count+1+1)/2);
-                       BCI_DRAW_INDICES_S3D(count, prim, start+2);
+                       BEGIN_BCI((count + 1 + 1) / 2);
+                       BCI_DRAW_INDICES_S3D(count, prim, start + 2);
 
-                       for (i = start+1; i+1 < start+count; i += 2)
+                       for (i = start + 1; i + 1 < start + count; i += 2)
                                BCI_WRITE((i + reorder[i % 3]) |
-                                         ((i+1 + reorder[(i+1) % 3]) << 16));
-                       if (i < start+count)
-                               BCI_WRITE(i + reorder[i%3]);
+                                         ((i + 1 +
+                                           reorder[(i + 1) % 3]) << 16));
+                       if (i < start + count)
+                               BCI_WRITE(i + reorder[i % 3]);
                } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-                       BEGIN_BCI((count+1+1)/2);
+                       BEGIN_BCI((count + 1 + 1) / 2);
                        BCI_DRAW_INDICES_S3D(count, prim, start);
 
-                       for (i = start+1; i+1 < start+count; i += 2)
-                               BCI_WRITE(i | ((i+1) << 16));
-                       if (i < start+count)
+                       for (i = start + 1; i + 1 < start + count; i += 2)
+                               BCI_WRITE(i | ((i + 1) << 16));
+                       if (i < start + count)
                                BCI_WRITE(i);
                } else {
-                       BEGIN_BCI((count+2+1)/2);
+                       BEGIN_BCI((count + 2 + 1) / 2);
                        BCI_DRAW_INDICES_S4(count, prim, skip);
 
-                       for (i = start; i+1 < start+count; i += 2)
-                               BCI_WRITE(i | ((i+1) << 16));
-                       if (i < start+count)
+                       for (i = start; i + 1 < start + count; i += 2)
+                               BCI_WRITE(i | ((i + 1) << 16));
+                       if (i < start + count)
                                BCI_WRITE(i);
                }
 
@@ -413,10 +415,9 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
        return 0;
 }
 
-static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
-                                  const drm_savage_cmd_header_t *cmd_header,
-                                  const uint32_t __user *vtxbuf,
-                                  unsigned int vb_size,
+static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
+                                  const drm_savage_cmd_header_t * cmd_header,
+                                  const uint32_t *vtxbuf, unsigned int vb_size,
                                   unsigned int vb_stride)
 {
        unsigned char reorder = 0;
@@ -445,8 +446,9 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
        case SAVAGE_PRIM_TRISTRIP:
        case SAVAGE_PRIM_TRIFAN:
                if (n < 3) {
-                       DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n",
-                                 n);
+                       DRM_ERROR
+                           ("wrong number of vertices %u in TRIFAN/STRIP\n",
+                            n);
                        return DRM_ERR(EINVAL);
                }
                break;
@@ -460,18 +462,18 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
                        return DRM_ERR(EINVAL);
                }
-               vtx_size = 8; /* full vertex */
+               vtx_size = 8;   /* full vertex */
        } else {
                if (skip > SAVAGE_SKIP_ALL_S4) {
                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
                        return DRM_ERR(EINVAL);
                }
-               vtx_size = 10; /* full vertex */
+               vtx_size = 10;  /* full vertex */
        }
 
        vtx_size -= (skip & 1) + (skip >> 1 & 1) +
-               (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
-               (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
+           (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
+           (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
 
        if (vtx_size > vb_stride) {
                DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
@@ -479,9 +481,9 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
                return DRM_ERR(EINVAL);
        }
 
-       if (start + n > vb_size / (vb_stride*4)) {
+       if (start + n > vb_size / (vb_stride * 4)) {
                DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
-                         start, start + n - 1, vb_size / (vb_stride*4));
+                         start, start + n - 1, vb_size / (vb_stride * 4));
                return DRM_ERR(EINVAL);
        }
 
@@ -493,31 +495,29 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
                        /* Need to reorder vertices for correct flat
                         * shading while preserving the clock sense
                         * for correct culling. Only on Savage3D. */
-                       int reorder[3] = {-1, -1, -1};
-                       reorder[start%3] = 2;
+                       int reorder[3] = { -1, -1, -1 };
+                       reorder[start % 3] = 2;
 
-                       BEGIN_DMA(count*vtx_size+1);
+                       BEGIN_DMA(count * vtx_size + 1);
                        DMA_DRAW_PRIMITIVE(count, prim, skip);
 
-                       for (i = start; i < start+count; ++i) {
+                       for (i = start; i < start + count; ++i) {
                                unsigned int j = i + reorder[i % 3];
-                               DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
-                                                  vtx_size);
+                               DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
                        }
 
                        DMA_COMMIT();
                } else {
-                       BEGIN_DMA(count*vtx_size+1);
+                       BEGIN_DMA(count * vtx_size + 1);
                        DMA_DRAW_PRIMITIVE(count, prim, skip);
 
                        if (vb_stride == vtx_size) {
-                               DMA_COPY_FROM_USER(&vtxbuf[vb_stride*start],
-                                                  vtx_size*count);
+                               DMA_COPY(&vtxbuf[vb_stride * start], 
+                                        vtx_size * count);
                        } else {
-                               for (i = start; i < start+count; ++i) {
-                                       DMA_COPY_FROM_USER(
-                                               &vtxbuf[vb_stride*i],
-                                               vtx_size);
+                               for (i = start; i < start + count; ++i) {
+                                       DMA_COPY(&vtxbuf [vb_stride * i],
+                                                vtx_size);
                                }
                        }
 
@@ -533,10 +533,10 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
        return 0;
 }
 
-static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
-                                  const drm_savage_cmd_header_t *cmd_header,
-                                  const uint16_t __user *usr_idx,
-                                  const drm_buf_t *dmabuf)
+static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
+                                  const drm_savage_cmd_header_t * cmd_header,
+                                  const uint16_t *idx,
+                                  const drm_buf_t * dmabuf)
 {
        unsigned char reorder = 0;
        unsigned int prim = cmd_header->idx.prim;
@@ -546,8 +546,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
        BCI_LOCALS;
 
        if (!dmabuf) {
-           DRM_ERROR("called without dma buffers!\n");
-           return DRM_ERR(EINVAL);
+               DRM_ERROR("called without dma buffers!\n");
+               return DRM_ERR(EINVAL);
        }
 
        if (!n)
@@ -559,16 +559,15 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
                prim = SAVAGE_PRIM_TRILIST;
        case SAVAGE_PRIM_TRILIST:
                if (n % 3 != 0) {
-                       DRM_ERROR("wrong number of indices %u in TRILIST\n",
-                                 n);
+                       DRM_ERROR("wrong number of indices %u in TRILIST\n", n);
                        return DRM_ERR(EINVAL);
                }
                break;
        case SAVAGE_PRIM_TRISTRIP:
        case SAVAGE_PRIM_TRIFAN:
                if (n < 3) {
-                       DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n",
-                                 n);
+                       DRM_ERROR
+                           ("wrong number of indices %u in TRIFAN/STRIP\n", n);
                        return DRM_ERR(EINVAL);
                }
                break;
@@ -579,17 +578,15 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
 
        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                if (skip != 0) {
-                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-                                 skip);
+                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
                        return DRM_ERR(EINVAL);
                }
        } else {
                unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
-                       (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
-                       (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
+                   (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
+                   (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
                if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
-                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-                                 skip);
+                       DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip);
                        return DRM_ERR(EINVAL);
                }
                if (reorder) {
@@ -625,15 +622,12 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
        while (n != 0) {
                /* Can emit up to 255 indices (85 triangles) at once. */
                unsigned int count = n > 255 ? 255 : n;
-               /* Is it ok to allocate 510 bytes on the stack in an ioctl? */
-               uint16_t idx[255];
 
-               /* Copy and check indices */
-               DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2);
+               /* check indices */
                for (i = 0; i < count; ++i) {
-                       if (idx[i] > dmabuf->total/32) {
+                       if (idx[i] > dmabuf->total / 32) {
                                DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
-                                         i, idx[i], dmabuf->total/32);
+                                         i, idx[i], dmabuf->total / 32);
                                return DRM_ERR(EINVAL);
                        }
                }
@@ -642,35 +636,36 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
                        /* Need to reorder indices for correct flat
                         * shading while preserving the clock sense
                         * for correct culling. Only on Savage3D. */
-                       int reorder[3] = {2, -1, -1};
+                       int reorder[3] = { 2, -1, -1 };
 
-                       BEGIN_BCI((count+1+1)/2);
+                       BEGIN_BCI((count + 1 + 1) / 2);
                        BCI_DRAW_INDICES_S3D(count, prim, idx[2]);
 
-                       for (i = 1; i+1 < count; i += 2)
+                       for (i = 1; i + 1 < count; i += 2)
                                BCI_WRITE(idx[i + reorder[i % 3]] |
-                                         (idx[i+1 + reorder[(i+1) % 3]] << 16));
+                                         (idx[i + 1 +
+                                          reorder[(i + 1) % 3]] << 16));
                        if (i < count)
-                               BCI_WRITE(idx[i + reorder[i%3]]);
+                               BCI_WRITE(idx[i + reorder[i % 3]]);
                } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-                       BEGIN_BCI((count+1+1)/2);
+                       BEGIN_BCI((count + 1 + 1) / 2);
                        BCI_DRAW_INDICES_S3D(count, prim, idx[0]);
 
-                       for (i = 1; i+1 < count; i += 2)
-                               BCI_WRITE(idx[i] | (idx[i+1] << 16));
+                       for (i = 1; i + 1 < count; i += 2)
+                               BCI_WRITE(idx[i] | (idx[i + 1] << 16));
                        if (i < count)
                                BCI_WRITE(idx[i]);
                } else {
-                       BEGIN_BCI((count+2+1)/2);
+                       BEGIN_BCI((count + 2 + 1) / 2);
                        BCI_DRAW_INDICES_S4(count, prim, skip);
 
-                       for (i = 0; i+1 < count; i += 2)
-                               BCI_WRITE(idx[i] | (idx[i+1] << 16));
+                       for (i = 0; i + 1 < count; i += 2)
+                               BCI_WRITE(idx[i] | (idx[i + 1] << 16));
                        if (i < count)
                                BCI_WRITE(idx[i]);
                }
 
-               usr_idx += count;
+               idx += count;
                n -= count;
 
                prim |= BCI_CMD_DRAW_CONT;
@@ -679,12 +674,11 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
        return 0;
 }
 
-static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
-                                 const drm_savage_cmd_header_t *cmd_header,
-                                 const uint16_t __user *usr_idx,
-                                 const uint32_t __user *vtxbuf,
-                                 unsigned int vb_size,
-                                 unsigned int vb_stride)
+static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
+                                 const drm_savage_cmd_header_t * cmd_header,
+                                 const uint16_t *idx,
+                                 const uint32_t *vtxbuf,
+                                 unsigned int vb_size, unsigned int vb_stride)
 {
        unsigned char reorder = 0;
        unsigned int prim = cmd_header->idx.prim;
@@ -703,16 +697,15 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
                prim = SAVAGE_PRIM_TRILIST;
        case SAVAGE_PRIM_TRILIST:
                if (n % 3 != 0) {
-                       DRM_ERROR("wrong number of indices %u in TRILIST\n",
-                                 n);
+                       DRM_ERROR("wrong number of indices %u in TRILIST\n", n);
                        return DRM_ERR(EINVAL);
                }
                break;
        case SAVAGE_PRIM_TRISTRIP:
        case SAVAGE_PRIM_TRIFAN:
                if (n < 3) {
-                       DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n",
-                                 n);
+                       DRM_ERROR
+                           ("wrong number of indices %u in TRIFAN/STRIP\n", n);
                        return DRM_ERR(EINVAL);
                }
                break;
@@ -726,18 +719,18 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
                        return DRM_ERR(EINVAL);
                }
-               vtx_size = 8; /* full vertex */
+               vtx_size = 8;   /* full vertex */
        } else {
                if (skip > SAVAGE_SKIP_ALL_S4) {
                        DRM_ERROR("invalid skip flags 0x%04x\n", skip);
                        return DRM_ERR(EINVAL);
                }
-               vtx_size = 10; /* full vertex */
+               vtx_size = 10;  /* full vertex */
        }
 
        vtx_size -= (skip & 1) + (skip >> 1 & 1) +
-               (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
-               (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
+           (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
+           (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
 
        if (vtx_size > vb_stride) {
                DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
@@ -749,15 +742,12 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
        while (n != 0) {
                /* Can emit up to 255 vertices (85 triangles) at once. */
                unsigned int count = n > 255 ? 255 : n;
-               /* Is it ok to allocate 510 bytes on the stack in an ioctl? */
-               uint16_t idx[255];
-
-               /* Copy and check indices */
-               DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2);
+               
+               /* Check indices */
                for (i = 0; i < count; ++i) {
-                       if (idx[i] > vb_size / (vb_stride*4)) {
+                       if (idx[i] > vb_size / (vb_stride * 4)) {
                                DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
-                                         i, idx[i],  vb_size / (vb_stride*4));
+                                         i, idx[i], vb_size / (vb_stride * 4));
                                return DRM_ERR(EINVAL);
                        }
                }
@@ -766,32 +756,30 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
                        /* Need to reorder vertices for correct flat
                         * shading while preserving the clock sense
                         * for correct culling. Only on Savage3D. */
-                       int reorder[3] = {2, -1, -1};
+                       int reorder[3] = { 2, -1, -1 };
 
-                       BEGIN_DMA(count*vtx_size+1);
+                       BEGIN_DMA(count * vtx_size + 1);
                        DMA_DRAW_PRIMITIVE(count, prim, skip);
 
                        for (i = 0; i < count; ++i) {
                                unsigned int j = idx[i + reorder[i % 3]];
-                               DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
-                                                  vtx_size);
+                               DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
                        }
 
                        DMA_COMMIT();
                } else {
-                       BEGIN_DMA(count*vtx_size+1);
+                       BEGIN_DMA(count * vtx_size + 1);
                        DMA_DRAW_PRIMITIVE(count, prim, skip);
 
                        for (i = 0; i < count; ++i) {
                                unsigned int j = idx[i];
-                               DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
-                                                  vtx_size);
+                               DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
                        }
 
                        DMA_COMMIT();
                }
 
-               usr_idx += count;
+               idx += count;
                n -= count;
 
                prim |= BCI_CMD_DRAW_CONT;
@@ -800,13 +788,13 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
        return 0;
 }
 
-static int savage_dispatch_clear(drm_savage_private_t *dev_priv,
-                                const drm_savage_cmd_header_t *cmd_header,
-                                const drm_savage_cmd_header_t __user *data,
+static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
+                                const drm_savage_cmd_header_t * cmd_header,
+                                const drm_savage_cmd_header_t *data,
                                 unsigned int nbox,
-                                const drm_clip_rect_t __user *usr_boxes)
+                                const drm_clip_rect_t *boxes)
 {
-       unsigned int flags = cmd_header->clear0.flags, mask, value;
+       unsigned int flags = cmd_header->clear0.flags;
        unsigned int clear_cmd;
        unsigned int i, nbufs;
        DMA_LOCALS;
@@ -814,42 +802,34 @@ static int savage_dispatch_clear(drm_savage_private_t *dev_priv,
        if (nbox == 0)
                return 0;
 
-       DRM_GET_USER_UNCHECKED(mask, &((const drm_savage_cmd_header_t*)data)
-                              ->clear1.mask);
-       DRM_GET_USER_UNCHECKED(value, &((const drm_savage_cmd_header_t*)data)
-                              ->clear1.value);
-
        clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
-               BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW;
-       BCI_CMD_SET_ROP(clear_cmd,0xCC);
+           BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW;
+       BCI_CMD_SET_ROP(clear_cmd, 0xCC);
 
        nbufs = ((flags & SAVAGE_FRONT) ? 1 : 0) +
-               ((flags & SAVAGE_BACK) ? 1 : 0) +
-               ((flags & SAVAGE_DEPTH) ? 1 : 0);
+           ((flags & SAVAGE_BACK) ? 1 : 0) + ((flags & SAVAGE_DEPTH) ? 1 : 0);
        if (nbufs == 0)
                return 0;
 
-       if (mask != 0xffffffff) {
+       if (data->clear1.mask != 0xffffffff) {
                /* set mask */
                BEGIN_DMA(2);
                DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
-               DMA_WRITE(mask);
+               DMA_WRITE(data->clear1.mask);
                DMA_COMMIT();
        }
        for (i = 0; i < nbox; ++i) {
-               drm_clip_rect_t box;
                unsigned int x, y, w, h;
                unsigned int buf;
-               DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-               x = box.x1, y = box.y1;
-               w = box.x2 - box.x1;
-               h = box.y2 - box.y1;
-               BEGIN_DMA(nbufs*6);
+               x = boxes[i].x1, y = boxes[i].y1;
+               w = boxes[i].x2 - boxes[i].x1;
+               h = boxes[i].y2 - boxes[i].y1;
+               BEGIN_DMA(nbufs * 6);
                for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) {
                        if (!(flags & buf))
                                continue;
                        DMA_WRITE(clear_cmd);
-                       switch(buf) {
+                       switch (buf) {
                        case SAVAGE_FRONT:
                                DMA_WRITE(dev_priv->front_offset);
                                DMA_WRITE(dev_priv->front_bd);
@@ -863,13 +843,13 @@ static int savage_dispatch_clear(drm_savage_private_t *dev_priv,
                                DMA_WRITE(dev_priv->depth_bd);
                                break;
                        }
-                       DMA_WRITE(value);
+                       DMA_WRITE(data->clear1.value);
                        DMA_WRITE(BCI_X_Y(x, y));
                        DMA_WRITE(BCI_W_H(w, h));
                }
                DMA_COMMIT();
        }
-       if (mask != 0xffffffff) {
+       if (data->clear1.mask != 0xffffffff) {
                /* reset mask */
                BEGIN_DMA(2);
                DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
@@ -880,9 +860,8 @@ static int savage_dispatch_clear(drm_savage_private_t *dev_priv,
        return 0;
 }
 
-static int savage_dispatch_swap(drm_savage_private_t *dev_priv,
-                               unsigned int nbox,
-                               const drm_clip_rect_t __user *usr_boxes)
+static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
+                               unsigned int nbox, const drm_clip_rect_t *boxes)
 {
        unsigned int swap_cmd;
        unsigned int i;
@@ -892,50 +871,45 @@ static int savage_dispatch_swap(drm_savage_private_t *dev_priv,
                return 0;
 
        swap_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
-               BCI_CMD_SRC_PBD_COLOR_NEW | BCI_CMD_DEST_GBD;
-       BCI_CMD_SET_ROP(swap_cmd,0xCC);
+           BCI_CMD_SRC_PBD_COLOR_NEW | BCI_CMD_DEST_GBD;
+       BCI_CMD_SET_ROP(swap_cmd, 0xCC);
 
        for (i = 0; i < nbox; ++i) {
-               drm_clip_rect_t box;
-               DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-
                BEGIN_DMA(6);
                DMA_WRITE(swap_cmd);
                DMA_WRITE(dev_priv->back_offset);
                DMA_WRITE(dev_priv->back_bd);
-               DMA_WRITE(BCI_X_Y(box.x1, box.y1));
-               DMA_WRITE(BCI_X_Y(box.x1, box.y1));
-               DMA_WRITE(BCI_W_H(box.x2-box.x1, box.y2-box.y1));
+               DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1));
+               DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1));
+               DMA_WRITE(BCI_W_H(boxes[i].x2 - boxes[i].x1,
+                                 boxes[i].y2 - boxes[i].y1));
                DMA_COMMIT();
        }
 
        return 0;
 }
 
-static int savage_dispatch_draw(drm_savage_private_t *dev_priv,
-                               const drm_savage_cmd_header_t __user *start,
-                               const drm_savage_cmd_header_t __user *end,
-                               const drm_buf_t *dmabuf,
-                               const unsigned int __user *usr_vtxbuf,
+static int savage_dispatch_draw(drm_savage_private_t * dev_priv,
+                               const drm_savage_cmd_header_t *start,
+                               const drm_savage_cmd_header_t *end,
+                               const drm_buf_t * dmabuf,
+                               const unsigned int *vtxbuf,
                                unsigned int vb_size, unsigned int vb_stride,
                                unsigned int nbox,
-                               const drm_clip_rect_t __user *usr_boxes)
+                               const drm_clip_rect_t *boxes)
 {
        unsigned int i, j;
        int ret;
 
        for (i = 0; i < nbox; ++i) {
-               drm_clip_rect_t box;
-               const drm_savage_cmd_header_t __user *usr_cmdbuf;
-               DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-               dev_priv->emit_clip_rect(dev_priv, &box);
+               const drm_savage_cmd_header_t *cmdbuf;
+               dev_priv->emit_clip_rect(dev_priv, &boxes[i]);
 
-               usr_cmdbuf = start;
-               while (usr_cmdbuf < end) {
+               cmdbuf = start;
+               while (cmdbuf < end) {
                        drm_savage_cmd_header_t cmd_header;
-                       DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
-                                                    sizeof(cmd_header));
-                       usr_cmdbuf++;
+                       cmd_header = *cmdbuf;
+                       cmdbuf++;
                        switch (cmd_header.cmd.cmd) {
                        case SAVAGE_CMD_DMA_PRIM:
                                ret = savage_dispatch_dma_prim(
@@ -944,27 +918,24 @@ static int savage_dispatch_draw(drm_savage_private_t *dev_priv,
                        case SAVAGE_CMD_VB_PRIM:
                                ret = savage_dispatch_vb_prim(
                                        dev_priv, &cmd_header,
-                                       (const uint32_t __user *)usr_vtxbuf,
-                                       vb_size, vb_stride);
+                                       vtxbuf, vb_size, vb_stride);
                                break;
                        case SAVAGE_CMD_DMA_IDX:
                                j = (cmd_header.idx.count + 3) / 4;
                                /* j was check in savage_bci_cmdbuf */
-                               ret = savage_dispatch_dma_idx(
-                                       dev_priv, &cmd_header,
-                                       (const uint16_t __user *)usr_cmdbuf,
+                               ret = savage_dispatch_dma_idx(dev_priv,
+                                       &cmd_header, (const uint16_t *)cmdbuf,
                                        dmabuf);
-                               usr_cmdbuf += j;
+                               cmdbuf += j;
                                break;
                        case SAVAGE_CMD_VB_IDX:
                                j = (cmd_header.idx.count + 3) / 4;
                                /* j was check in savage_bci_cmdbuf */
-                               ret = savage_dispatch_vb_idx(
-                                       dev_priv, &cmd_header,
-                                       (const uint16_t __user *)usr_cmdbuf,
-                                       (const uint32_t __user *)usr_vtxbuf,
-                                       vb_size, vb_stride);
-                               usr_cmdbuf += j;
+                               ret = savage_dispatch_vb_idx(dev_priv,
+                                       &cmd_header, (const uint16_t *)cmdbuf,
+                                       (const uint32_t *)vtxbuf, vb_size, 
+                                       vb_stride);
+                               cmdbuf += j;
                                break;
                        default:
                                /* What's the best return code? EFAULT? */
@@ -989,24 +960,25 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
        drm_device_dma_t *dma = dev->dma;
        drm_buf_t *dmabuf;
        drm_savage_cmdbuf_t cmdbuf;
-       drm_savage_cmd_header_t __user *usr_cmdbuf;
-       drm_savage_cmd_header_t __user *first_draw_cmd;
-       unsigned int __user *usr_vtxbuf;
-       drm_clip_rect_t __user *usr_boxes;
+       drm_savage_cmd_header_t *kcmd_addr = NULL;
+       drm_savage_cmd_header_t *first_draw_cmd;
+       unsigned int *kvb_addr = NULL;
+       drm_clip_rect_t *kbox_addr = NULL;
        unsigned int i, j;
        int ret = 0;
 
        DRM_DEBUG("\n");
-       
+
        LOCK_TEST_WITH_RETURN(dev, filp);
 
-       DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *)data,
+       DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *) data,
                                 sizeof(cmdbuf));
 
        if (dma && dma->buflist) {
                if (cmdbuf.dma_idx > dma->buf_count) {
-                       DRM_ERROR("vertex buffer index %u out of range (0-%u)\n",
-                                 cmdbuf.dma_idx, dma->buf_count-1);
+                       DRM_ERROR
+                           ("vertex buffer index %u out of range (0-%u)\n",
+                            cmdbuf.dma_idx, dma->buf_count - 1);
                        return DRM_ERR(EINVAL);
                }
                dmabuf = dma->buflist[cmdbuf.dma_idx];
@@ -1014,15 +986,53 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                dmabuf = NULL;
        }
 
-       usr_cmdbuf = (drm_savage_cmd_header_t __user *)cmdbuf.cmd_addr;
-       usr_vtxbuf = (unsigned int __user *)cmdbuf.vb_addr;
-       usr_boxes = (drm_clip_rect_t __user *)cmdbuf.box_addr;
-       if ((cmdbuf.size && DRM_VERIFYAREA_READ(usr_cmdbuf, cmdbuf.size*8)) ||
-           (cmdbuf.vb_size && DRM_VERIFYAREA_READ(
-                   usr_vtxbuf, cmdbuf.vb_size)) ||
-           (cmdbuf.nbox && DRM_VERIFYAREA_READ(
-                   usr_boxes, cmdbuf.nbox*sizeof(drm_clip_rect_t))))
-               return DRM_ERR(EFAULT);
+       /* Copy the user buffers into kernel temporary areas.  This hasn't been
+        * a performance loss compared to VERIFYAREA_READ/
+        * COPY_FROM_USER_UNCHECKED when done in other drivers, and is correct
+        * for locking on FreeBSD.
+        */
+       if (cmdbuf.size) {
+               kcmd_addr = drm_alloc(cmdbuf.size * 8, DRM_MEM_DRIVER);
+               if (kcmd_addr == NULL)
+                       return ENOMEM;
+
+               if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf.cmd_addr,
+                                      cmdbuf.size * 8))
+               {
+                       drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
+                       return DRM_ERR(EFAULT);
+               }
+               cmdbuf.cmd_addr = kcmd_addr;
+       }
+       if (cmdbuf.vb_size) {
+               kvb_addr = drm_alloc(cmdbuf.vb_size, DRM_MEM_DRIVER);
+               if (kvb_addr == NULL) {
+                       ret = DRM_ERR(ENOMEM);
+                       goto done;
+               }
+
+               if (DRM_COPY_FROM_USER(kvb_addr, cmdbuf.vb_addr,
+                                      cmdbuf.vb_size)) {
+                       ret = DRM_ERR(EFAULT);
+                       goto done;
+               }
+               cmdbuf.vb_addr = kvb_addr;
+       }
+       if (cmdbuf.nbox) {
+               kbox_addr = drm_alloc(cmdbuf.nbox * sizeof(drm_clip_rect_t),
+                                      DRM_MEM_DRIVER);
+               if (kbox_addr == NULL) {
+                       ret = DRM_ERR(ENOMEM);
+                       goto done;
+               }
+
+               if (DRM_COPY_FROM_USER(kbox_addr, cmdbuf.box_addr,
+                                      cmdbuf.nbox * sizeof(drm_clip_rect_t))) {
+                       ret = DRM_ERR(EFAULT);
+                       goto done;
+               }
+       cmdbuf.box_addr = kbox_addr;
+       }
 
        /* Make sure writes to DMA buffers are finished before sending
         * DMA commands to the graphics hardware. */
@@ -1036,9 +1046,8 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
        first_draw_cmd = NULL;
        while (i < cmdbuf.size) {
                drm_savage_cmd_header_t cmd_header;
-               DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
-                                            sizeof(cmd_header));
-               usr_cmdbuf++;
+               cmd_header = *(drm_savage_cmd_header_t *)cmdbuf.cmd_addr;
+               cmdbuf.cmd_addr++;
                i++;
 
                /* Group drawing commands with same state to minimize
@@ -1058,17 +1067,18 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                case SAVAGE_CMD_DMA_PRIM:
                case SAVAGE_CMD_VB_PRIM:
                        if (!first_draw_cmd)
-                               first_draw_cmd = usr_cmdbuf-1;
-                       usr_cmdbuf += j;
+                               first_draw_cmd = cmdbuf.cmd_addr - 1;
+                       cmdbuf.cmd_addr += j;
                        i += j;
                        break;
                default:
                        if (first_draw_cmd) {
-                               ret = savage_dispatch_draw (
-                                       dev_priv, first_draw_cmd, usr_cmdbuf-1,
-                                       dmabuf, usr_vtxbuf, cmdbuf.vb_size,
-                                       cmdbuf.vb_stride,
-                                       cmdbuf.nbox, usr_boxes);
+                               ret = savage_dispatch_draw(
+                                     dev_priv, first_draw_cmd,
+                                     cmdbuf.cmd_addr - 1,
+                                     dmabuf, cmdbuf.vb_addr, cmdbuf.vb_size,
+                                     cmdbuf.vb_stride,
+                                     cmdbuf.nbox, cmdbuf.box_addr);
                                if (ret != 0)
                                        return ret;
                                first_draw_cmd = NULL;
@@ -1084,12 +1094,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                                DRM_ERROR("command SAVAGE_CMD_STATE extends "
                                          "beyond end of command buffer\n");
                                DMA_FLUSH();
-                               return DRM_ERR(EINVAL);
+                               ret = DRM_ERR(EINVAL);
+                               goto done;
                        }
-                       ret = savage_dispatch_state(
-                               dev_priv, &cmd_header,
-                               (uint32_t __user *)usr_cmdbuf);
-                       usr_cmdbuf += j;
+                       ret = savage_dispatch_state(dev_priv, &cmd_header,
+                               (const uint32_t *)cmdbuf.cmd_addr);
+                       cmdbuf.cmd_addr += j;
                        i += j;
                        break;
                case SAVAGE_CMD_CLEAR:
@@ -1097,38 +1107,40 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                                DRM_ERROR("command SAVAGE_CMD_CLEAR extends "
                                          "beyond end of command buffer\n");
                                DMA_FLUSH();
-                               return DRM_ERR(EINVAL);
+                               ret = DRM_ERR(EINVAL);
+                               goto done;
                        }
                        ret = savage_dispatch_clear(dev_priv, &cmd_header,
-                                                   usr_cmdbuf,
-                                                   cmdbuf.nbox, usr_boxes);
-                       usr_cmdbuf++;
+                                                   cmdbuf.cmd_addr,
+                                                   cmdbuf.nbox, cmdbuf.box_addr);
+                       cmdbuf.cmd_addr++;
                        i++;
                        break;
                case SAVAGE_CMD_SWAP:
-                       ret = savage_dispatch_swap(dev_priv,
-                                                  cmdbuf.nbox, usr_boxes);
+                       ret = savage_dispatch_swap(dev_priv, cmdbuf.nbox,
+                                                  cmdbuf.box_addr);
                        break;
                default:
                        DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd);
                        DMA_FLUSH();
-                       return DRM_ERR(EINVAL);
+                       ret = DRM_ERR(EINVAL);
+                       goto done;
                }
 
                if (ret != 0) {
                        DMA_FLUSH();
-                       return ret;
+                       goto done;
                }
        }
 
        if (first_draw_cmd) {
                ret = savage_dispatch_draw (
-                       dev_priv, first_draw_cmd, usr_cmdbuf, dmabuf,
-                       usr_vtxbuf, cmdbuf.vb_size, cmdbuf.vb_stride,
-                       cmdbuf.nbox, usr_boxes);
+                       dev_priv, first_draw_cmd, cmdbuf.cmd_addr, dmabuf,
+                       cmdbuf.vb_addr, cmdbuf.vb_size, cmdbuf.vb_stride,
+                       cmdbuf.nbox, cmdbuf.box_addr);
                if (ret != 0) {
                        DMA_FLUSH();
-                       return ret;
+                       goto done;
                }
        }
 
@@ -1142,5 +1154,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                savage_freelist_put(dev, dmabuf);
        }
 
-       return 0;
+done:
+       /* If we didn't need to allocate them, these'll be NULL */
+       drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
+       drm_free(kvb_addr, cmdbuf.vb_size, DRM_MEM_DRIVER);
+       drm_free(kbox_addr, cmdbuf.nbox * sizeof(drm_clip_rect_t),
+                DRM_MEM_DRIVER);
+
+       return ret;
 }