Index: kernel/generic/include/ipc/ipc.h
===================================================================
--- kernel/generic/include/ipc/ipc.h	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ kernel/generic/include/ipc/ipc.h	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -175,13 +175,11 @@
 
 /** Send data to another address space over IPC.
- * - ARG1 - destination address space virtual address, may be overriden by the
- *	    recipient
- * - ARG2 - source address space virtual address
- * - ARG3 - size of data to be copied, may be overriden by the recipient
+ * - ARG1 - source address space virtual address
+ * - ARG2 - size of data to be copied, may be overriden by the recipient
  *
  * on answer, the recipient must set:
  *
  * - ARG1 - final destination address space virtual address
- * - ARG3 - final size of data to be copied
+ * - ARG2 - final size of data to be copied
  */
 #define IPC_M_DATA_WRITE	6
Index: kernel/generic/src/ipc/sysipc.c
===================================================================
--- kernel/generic/src/ipc/sysipc.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ kernel/generic/src/ipc/sysipc.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -273,6 +273,6 @@
 
 			dst = IPC_GET_ARG1(answer->data);
-			size = IPC_GET_ARG3(answer->data);
-			max_size = IPC_GET_ARG3(*olddata);
+			size = IPC_GET_ARG2(answer->data);
+			max_size = IPC_GET_ARG2(*olddata);
 
 			if (size <= max_size) {
@@ -326,6 +326,6 @@
 		break;
 	case IPC_M_DATA_WRITE:
-		src = IPC_GET_ARG2(call->data);
-		size = IPC_GET_ARG3(call->data);
+		src = IPC_GET_ARG1(call->data);
+		size = IPC_GET_ARG2(call->data);
 		
 		if ((size <= 0) || (size > DATA_XFER_LIMIT))
Index: uspace/lib/libc/generic/ipc.c
===================================================================
--- uspace/lib/libc/generic/ipc.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/lib/libc/generic/ipc.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -736,5 +736,5 @@
 int ipc_data_write_send(int phoneid, void *src, size_t size)
 {
-	return ipc_call_sync_3_0(phoneid, IPC_M_DATA_WRITE, 0, (ipcarg_t) src,
+	return ipc_call_sync_2_0(phoneid, IPC_M_DATA_WRITE, (ipcarg_t) src,
 	    (ipcarg_t) size);
 }
@@ -749,6 +749,4 @@
  * @param callid	Storage where the hash of the IPC_M_DATA_WRITE call will
  * 			be stored.
- * @param dst		Storage where the suggested destination address will
- *			be stored. May be NULL.
  * @param size		Storage where the suggested size will be stored. May be
  *			NULL
@@ -756,5 +754,5 @@
  * @return		Non-zero on success, zero on failure.
  */
-int ipc_data_write_receive(ipc_callid_t *callid, void **dst, size_t *size)
+int ipc_data_write_receive(ipc_callid_t *callid, size_t *size)
 {
 	ipc_call_t data;
@@ -765,8 +763,6 @@
 	if (IPC_GET_METHOD(data) != IPC_M_DATA_WRITE)
 		return 0;
-	if (dst)
-		*dst = (void *) IPC_GET_ARG1(data);
 	if (size)
-		*size = (size_t) IPC_GET_ARG3(data);
+		*size = (size_t) IPC_GET_ARG2(data);
 	return 1;
 }
@@ -785,5 +781,5 @@
 int ipc_data_write_deliver(ipc_callid_t callid, void *dst, size_t size)
 {
-	return ipc_answer_3(callid, EOK, (ipcarg_t) dst, 0, (ipcarg_t) size);
+	return ipc_answer_2(callid, EOK, (ipcarg_t) dst, (ipcarg_t) size);
 }
  
Index: uspace/lib/libc/include/ipc/ipc.h
===================================================================
--- uspace/lib/libc/include/ipc/ipc.h	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/lib/libc/include/ipc/ipc.h	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -267,6 +267,5 @@
 extern int ipc_data_read_deliver(ipc_callid_t callid, void *src, size_t size);
 extern int ipc_data_write_send(int phoneid, void *src, size_t size);
-extern int ipc_data_write_receive(ipc_callid_t *callid, void **dst,
-    size_t *size);
+extern int ipc_data_write_receive(ipc_callid_t *callid, size_t *size);
 extern int ipc_data_write_deliver(ipc_callid_t callid, void *dst, size_t size);
 
Index: uspace/srv/devmap/devmap.c
===================================================================
--- uspace/srv/devmap/devmap.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/srv/devmap/devmap.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -203,5 +203,5 @@
 	 * Get driver name
 	 */
-	if (!ipc_data_write_receive(&callid, NULL, &name_size)) {
+	if (!ipc_data_write_receive(&callid, &name_size)) {
 		printf("Unexpected request.\n");
 		free(driver);
@@ -369,5 +369,5 @@
 	
 	/* Get device name */
-	if (!ipc_data_write_receive(&callid, NULL, &size)) {
+	if (!ipc_data_write_receive(&callid, &size)) {
 		free(device);
 		printf("Cannot read device name.\n");
@@ -490,5 +490,5 @@
 	 * read the name itself until the buffer is allocated).
 	 */
-	if (!ipc_data_write_receive(&callid, NULL, &name_size)) {
+	if (!ipc_data_write_receive(&callid, &name_size)) {
 		ipc_answer_0(callid, EREFUSED);
 		ipc_answer_0(iid, EREFUSED);
Index: uspace/srv/fs/tmpfs/tmpfs_ops.c
===================================================================
--- uspace/srv/fs/tmpfs/tmpfs_ops.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/srv/fs/tmpfs/tmpfs_ops.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -339,5 +339,5 @@
 	ipc_callid_t callid;
 	size_t len;
-	if (!ipc_data_write_receive(&callid, NULL, &len)) {
+	if (!ipc_data_write_receive(&callid, &len)) {
 		ipc_answer_0(callid, EINVAL);	
 		ipc_answer_0(rid, EINVAL);
Index: uspace/srv/vfs/vfs_mount.c
===================================================================
--- uspace/srv/vfs/vfs_mount.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/srv/vfs/vfs_mount.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -87,5 +87,5 @@
 	 * system.
 	 */
-	if (!ipc_data_write_receive(&callid, NULL, &size)) {
+	if (!ipc_data_write_receive(&callid, &size)) {
 		ipc_answer_0(callid, EINVAL);
 		ipc_answer_0(rid, EINVAL);
@@ -123,5 +123,5 @@
 	 * Now, we want the client to send us the mount point.
 	 */
-	if (!ipc_data_write_receive(&callid, NULL, &size)) {
+	if (!ipc_data_write_receive(&callid, &size)) {
 		ipc_answer_0(callid, EINVAL);
 		ipc_answer_0(rid, EINVAL);
Index: uspace/srv/vfs/vfs_open.c
===================================================================
--- uspace/srv/vfs/vfs_open.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/srv/vfs/vfs_open.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -62,5 +62,5 @@
 	ipc_callid_t callid;
 
-	if (!ipc_data_write_receive(&callid, NULL, &size)) {
+	if (!ipc_data_write_receive(&callid, &size)) {
 		ipc_answer_0(callid, EINVAL);
 		ipc_answer_0(rid, EINVAL);
Index: uspace/srv/vfs/vfs_rdwr.c
===================================================================
--- uspace/srv/vfs/vfs_rdwr.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/srv/vfs/vfs_rdwr.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -74,5 +74,5 @@
 		res = ipc_data_read_receive(&callid, NULL);
 	else 
-		res = ipc_data_write_receive(&callid, NULL, NULL);
+		res = ipc_data_write_receive(&callid, NULL);
 	if (!res) {
 		ipc_answer_0(callid, EINVAL);
Index: uspace/srv/vfs/vfs_register.c
===================================================================
--- uspace/srv/vfs/vfs_register.c	(revision badbd888ca37567fce496cb0f320a8e72e9dee6e)
+++ uspace/srv/vfs/vfs_register.c	(revision 3115355436bd3be893ea7ad92686758cb9124a41)
@@ -165,5 +165,5 @@
 	 * VFS info structure from the client FS.
 	 */
-	if (!ipc_data_write_receive(&callid, NULL, &size)) {
+	if (!ipc_data_write_receive(&callid, &size)) {
 		/*
 		 * The client doesn't obey the same protocol as we do.