drm_radeon_cmd_buffer_t cmdbuf; 
drm_radeon_kcmd_buffer_t cmdbuf; 
static int radeon_cp_cmdbuf(DRM_IOCTL_ARGS){	DRM_DEVICE;	drm_radeon_private_t *dev_priv = dev->dev_private;	drm_file_t *filp_priv;	drm_device_dma_t *dma = dev->dma;	drm_buf_t *buf = NULL;	int idx;	drm_radeon_cmd_buffer_t cmdbuf;	drm_radeon_cmd_header_t header;	int orig_nbox, orig_bufsz;	char *kbuf = NULL;	LOCK_TEST_WITH_RETURN(dev, filp);	if (!dev_priv) {		DRM_ERROR("%s called with no initialization\n", __FUNCTION__);		return DRM_ERR(EINVAL);	}	DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);	DRM_COPY_FROM_USER_IOCTL(cmdbuf,				 (drm_radeon_cmd_buffer_t __user *) data,				 sizeof(cmdbuf));	RING_SPACE_TEST_WITH_RETURN(dev_priv);	VB_AGE_TEST_WITH_RETURN(dev_priv);	if (cmdbuf.bufsz > 64 * 1024 || cmdbuf.bufsz < 0) {		return DRM_ERR(EINVAL);	}	/* Allocate an in-kernel area and copy in the cmdbuf.  Do this to avoid	 * races between checking values and using those values in other code,	 * and simply to avoid a lot of function calls to copy in data.	 */	orig_bufsz = cmdbuf.bufsz;	if (orig_bufsz != 0) {		kbuf = drm_alloc(cmdbuf.bufsz, DRM_MEM_DRIVER);		if (kbuf == NULL)			return DRM_ERR(ENOMEM);		if (DRM_COPY_FROM_USER(kbuf, cmdbuf.buf, cmdbuf.bufsz)) {			drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);			return DRM_ERR(EFAULT);		}		cmdbuf.buf = kbuf;	}	orig_nbox = cmdbuf.nbox;	if (dev_priv->microcode_version == UCODE_R300) {		int temp;		temp = r300_do_cp_cmdbuf(dev, filp, filp_priv, &cmdbuf);		if (orig_bufsz != 0)			drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);		return temp;	}	/* microcode_version != r300 */	while (cmdbuf.bufsz >= sizeof(header)) {		header.i = *(int *)cmdbuf.buf;		cmdbuf.buf += sizeof(header);		cmdbuf.bufsz -= sizeof(header);		switch (header.header.cmd_type) {		case RADEON_CMD_PACKET:			DRM_DEBUG("RADEON_CMD_PACKET\n");			if (radeon_emit_packets			    (dev_priv, filp_priv, header, &cmdbuf)) {				DRM_ERROR("radeon_emit_packets failed\n");				goto err;			}			break;		case RADEON_CMD_SCALARS:			DRM_DEBUG("RADEON_CMD_SCALARS\n");			if (radeon_emit_scalars(dev_priv, header, &cmdbuf)) {				DRM_ERROR("radeon_emit_scalars failed\n");				goto err;			}			break;		case RADEON_CMD_VECTORS:			DRM_DEBUG("RADEON_CMD_VECTORS\n");			if (radeon_emit_vectors(dev_priv, header, &cmdbuf)) {				DRM_ERROR("radeon_emit_vectors failed\n");				goto err;			}			break;		case RADEON_CMD_DMA_DISCARD:			DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");			idx = header.dma.buf_idx;			if (idx < 0 || idx >= dma->buf_count) {				DRM_ERROR("buffer index %d (of %d max)\n",					  idx, dma->buf_count - 1);				goto err;			}			buf = dma->buflist[idx];			if (buf->filp != filp || buf->pending) {				DRM_ERROR("bad buffer %p %p %d\n",					  buf->filp, filp, buf->pending);				goto err;			}			radeon_cp_discard_buffer(dev, buf);			break;		case RADEON_CMD_PACKET3:			DRM_DEBUG("RADEON_CMD_PACKET3\n");			if (radeon_emit_packet3(dev, filp_priv, &cmdbuf)) {				DRM_ERROR("radeon_emit_packet3 failed\n");				goto err;			}			break;		case RADEON_CMD_PACKET3_CLIP:			DRM_DEBUG("RADEON_CMD_PACKET3_CLIP\n");			if (radeon_emit_packet3_cliprect			    (dev, filp_priv, &cmdbuf, orig_nbox)) {				DRM_ERROR("radeon_emit_packet3_clip failed\n");				goto err;			}			break;		case RADEON_CMD_SCALARS2:			DRM_DEBUG("RADEON_CMD_SCALARS2\n");			if (radeon_emit_scalars2(dev_priv, header, &cmdbuf)) {				DRM_ERROR("radeon_emit_scalars2 failed\n");				goto err;			}			break;		case RADEON_CMD_WAIT:			DRM_DEBUG("RADEON_CMD_WAIT\n");			if (radeon_emit_wait(dev, header.wait.flags)) {				DRM_ERROR("radeon_emit_wait failed\n");				goto err;			}			break;		default:			DRM_ERROR("bad cmd_type %d at %p\n",				  header.header.cmd_type,				  cmdbuf.buf - sizeof(header));			goto err;		}	}	if (orig_bufsz != 0)		drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);	DRM_DEBUG("DONE\n");	COMMIT_RING();	return 0;      err:	if (orig_bufsz != 0)		drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);	return DRM_ERR(EINVAL);}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/b3a83639895a422b25f72eec0a5d1d88c3ac4e9e/radeon_state.c/buggy/drivers/char/drm/radeon_state.c