drm_radeon_cmd_buffer_t * cmdbuf, 
drm_radeon_kcmd_buffer_t *cmdbuf, 
static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *						     dev_priv,						     drm_file_t * filp_priv,						     drm_radeon_cmd_buffer_t *						     cmdbuf,						     unsigned int *cmdsz){	u32 *cmd = (u32 *) cmdbuf->buf;	*cmdsz = 2 + ((cmd[0] & RADEON_CP_PACKET_COUNT_MASK) >> 16);	if ((cmd[0] & 0xc0000000) != RADEON_CP_PACKET3) {		DRM_ERROR("Not a type 3 packet\n");		return DRM_ERR(EINVAL);	}	if (4 * *cmdsz > cmdbuf->bufsz) {		DRM_ERROR("Packet size larger than size of data provided\n");		return DRM_ERR(EINVAL);	}	/* Check client state and fix it up if necessary */	if (cmd[0] & 0x8000) {	/* MSB of opcode: next DWORD GUI_CNTL */		u32 offset;		if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL			      | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {			offset = cmd[2] << 10;			if (radeon_check_and_fixup_offset			    (dev_priv, filp_priv, &offset)) {				DRM_ERROR("Invalid first packet offset\n");				return DRM_ERR(EINVAL);			}			cmd[2] = (cmd[2] & 0xffc00000) | offset >> 10;		}		if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&		    (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {			offset = cmd[3] << 10;			if (radeon_check_and_fixup_offset			    (dev_priv, filp_priv, &offset)) {				DRM_ERROR("Invalid second packet offset\n");				return DRM_ERR(EINVAL);			}			cmd[3] = (cmd[3] & 0xffc00000) | offset >> 10;		}	}	return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/b3a83639895a422b25f72eec0a5d1d88c3ac4e9e/radeon_state.c/buggy/drivers/char/drm/radeon_state.c