OUT_RING_TABLE((int __user *)(cmdbuf->buf + 4), count + 1); 
OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1); 
static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t * dev_priv,					    drm_radeon_cmd_buffer_t * cmdbuf){	u32 header;	int count;	RING_LOCALS;	if (4 > cmdbuf->bufsz)		return DRM_ERR(EINVAL);	/* Fixme !! This simply emits a packet without much checking.	   We need to be smarter. */	/* obtain first word - actual packet3 header */	header = *(u32 __user *) cmdbuf->buf;	/* Is it packet 3 ? */	if ((header >> 30) != 0x3) {		DRM_ERROR("Not a packet3 header (0x%08x)\n", header);		return DRM_ERR(EINVAL);	}	count = (header >> 16) & 0x3fff;	/* Check again now that we know how much data to expect */	if ((count + 2) * 4 > cmdbuf->bufsz) {		DRM_ERROR		    ("Expected packet3 of length %d but have only %d bytes left\n",		     (count + 2) * 4, cmdbuf->bufsz);		return DRM_ERR(EINVAL);	}	/* Is it a packet type we know about ? */	switch (header & 0xff00) {	case RADEON_3D_LOAD_VBPNTR:	/* load vertex array pointers */		return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);	case RADEON_CP_3D_DRAW_IMMD_2:	/* triggers drawing using in-packet vertex data */	case RADEON_CP_3D_DRAW_VBUF_2:	/* triggers drawing of vertex buffers setup elsewhere */	case RADEON_CP_3D_DRAW_INDX_2:	/* triggers drawing using indices to vertex buffer */	case RADEON_CP_INDX_BUFFER:	/* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */	case RADEON_WAIT_FOR_IDLE:	case RADEON_CP_NOP:		/* these packets are safe */		break;	default:		DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);		return DRM_ERR(EINVAL);	}	BEGIN_RING(count + 2);	OUT_RING(header);	OUT_RING_TABLE((int __user *)(cmdbuf->buf + 4), count + 1);	ADVANCE_RING();	cmdbuf->buf += (count + 2) * 4;	cmdbuf->bufsz -= (count + 2) * 4;	return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/b3a83639895a422b25f72eec0a5d1d88c3ac4e9e/r300_cmdbuf.c/buggy/drivers/char/drm/r300_cmdbuf.c