drm_radeon_cmd_buffer_t 
drm_radeon_kcmd_buffer_t 
static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *							  dev_priv,							  drm_radeon_cmd_buffer_t							  * cmdbuf,							  drm_r300_cmd_header_t							  header){	int reg;	int sz;	int i;	int values[64];	RING_LOCALS;	sz = header.packet0.count;	reg = (header.packet0.reghi << 8) | header.packet0.reglo;	if ((sz > 64) || (sz < 0)) {		DRM_ERROR		    ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",		     reg, sz);		return DRM_ERR(EINVAL);	}	for (i = 0; i < sz; i++) {		values[i] = ((int __user *)cmdbuf->buf)[i];		switch (r300_reg_flags[(reg >> 2) + i]) {		case MARK_SAFE:			break;		case MARK_CHECK_OFFSET:			if (r300_check_offset(dev_priv, (u32) values[i])) {				DRM_ERROR				    ("Offset failed range check (reg=%04x sz=%d)\n",				     reg, sz);				return DRM_ERR(EINVAL);			}			break;		default:			DRM_ERROR("Register %04x failed check as flag=%02x\n",				  reg + i * 4, r300_reg_flags[(reg >> 2) + i]);			return DRM_ERR(EINVAL);		}	}	BEGIN_RING(1 + sz);	OUT_RING(CP_PACKET0(reg, sz - 1));	OUT_RING_TABLE(values, sz);	ADVANCE_RING();	cmdbuf->buf += sz * 4;	cmdbuf->bufsz -= sz * 4;	return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/b3a83639895a422b25f72eec0a5d1d88c3ac4e9e/r300_cmdbuf.c/buggy/drivers/char/drm/r300_cmdbuf.c