Attachment 32964 Details for Bug 23993 – Second try to fix the memory allocation. Still needs r300 testing.

[patch] Second try to fix the memory allocation. Still needs r300 testing.

radeon_drm_buffer.diff (text/plain), 48.02 KB, created by Pauli on 2010-02-01 03:56:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Pauli

Created: 2010-02-01 03:56:13 UTC

Size: 48.02 KB

patch

obsolete

>diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
>index 39c5aa7..abe3f44 100644
>--- a/drivers/gpu/drm/Makefile
>+++ b/drivers/gpu/drm/Makefile
>@@ -4,7 +4,7 @@
> 
> ccflags-y := -Iinclude/drm
> 
>-drm-y       :=	drm_auth.o drm_bufs.o drm_cache.o \
>+drm-y       :=	drm_auth.o drm_buffer.o drm_bufs.o drm_cache.o \
> 		drm_context.o drm_dma.o drm_drawable.o \
> 		drm_drv.o drm_fops.o drm_gem.o drm_ioctl.o drm_irq.o \
> 		drm_lock.o drm_memory.o drm_proc.o drm_stub.o drm_vm.o \
>diff --git a/drivers/gpu/drm/drm_buffer.c b/drivers/gpu/drm/drm_buffer.c
>new file mode 100644
>index 0000000..b39563b
>--- /dev/null
>+++ b/drivers/gpu/drm/drm_buffer.c
>@@ -0,0 +1,175 @@
>+/**************************************************************************
>+ *
>+ * Copyright 2010 Pauli Nieminen.
>+ * All Rights Reserved.
>+ *
>+ * Permission is hereby granted, free of charge, to any person obtaining a
>+ * copy of this software and associated documentation files (the
>+ * "Software"), to deal in the Software without restriction, including
>+ * without limitation the rights to use, copy, modify, merge, publish,
>+ * distribute, sub license, and/or sell copies of the Software, and to
>+ * permit persons to whom the Software is furnished to do so, subject to
>+ * the following conditions:
>+ *
>+ * The above copyright notice and this permission notice (including the
>+ * next paragraph) shall be included in all copies or substantial portions
>+ * of the Software.
>+ *
>+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
>+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
>+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
>+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
>+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
>+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
>+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
>+ *
>+ *
>+ **************************************************************************/
>+/*
>+ * Multipart buffer for coping data which is larger than page size.
>+ *
>+ * Authors:
>+ * Pauli Nieminen <suokkos-at-gmail-dot-com>
>+ */
>+
>+#include "drm_buffer.h"
>+
>+/**
>+ * Allocate and initialize the drm buffer object.
>+ */
>+int drm_buffer_alloc(drm_buffer_t **buf, int size)
>+{
>+	int nr_pages = size / PAGE_SIZE + 1;
>+	int idx;
>+
>+	/* Allocating pointer table to end of structure makes drm_buffer
>+	 * variable sized */
>+	*buf = kzalloc(sizeof(drm_buffer_t) + nr_pages*sizeof(char*), GFP_KERNEL);
>+	if (*buf == NULL) {
>+		DRM_ERROR("Failed to allocate drm buffer object to hold"
>+				" %d bytes in %d pages.\n",
>+				size, nr_pages);
>+		return -ENOMEM;
>+	}
>+
>+	(*buf)->size = size;
>+
>+	for (idx = 0; idx < nr_pages; ++idx) {
>+
>+		(*buf)->data[idx] = kcalloc(sizeof((*buf)->data[idx]),
>+			min(PAGE_SIZE, size - idx * PAGE_SIZE),
>+			GFP_KERNEL);
>+
>+
>+		if ((*buf)->data[idx] == NULL) {
>+			DRM_ERROR("Failed to allocate %dth page for drm"
>+					" buffer with %d bytes and %d pages.\n",
>+					idx + 1, size, nr_pages);
>+			goto error_out;
>+		}
>+
>+	}
>+
>+	return 0;
>+
>+error_out:
>+
>+	// Only last element can be null pointer so check for it first
>+	if ((*buf)->data[idx])
>+		kfree((*buf)->data[idx--]);
>+
>+	for (;idx >= 0; --idx)
>+		kfree((*buf)->data[idx]);
>+
>+	kfree(*buf);
>+	return -ENOMEM;
>+}
>+
>+EXPORT_SYMBOL(drm_buffer_alloc);
>+
>+/**
>+ * Copy the user data to the begin of the buffer and reset the processing
>+ * iterator.
>+ */
>+extern int drm_buffer_copy_from_user(drm_buffer_t *buf,
>+		void __user *user_data, int size)
>+{
>+	int nr_pages = size / PAGE_SIZE + 1;
>+	int idx;
>+
>+	if (size > buf->size) {
>+		DRM_ERROR("Requesting to copy %d bytes to a drm buffer with"
>+				" %d bytes space\n",
>+				size, buf->size);
>+		return -EFAULT;
>+	}
>+
>+	for (idx = 0; idx < nr_pages; ++idx) {
>+
>+		if (DRM_COPY_FROM_USER(buf->data[idx],
>+			user_data + idx * PAGE_SIZE,
>+			min(PAGE_SIZE, size - idx * PAGE_SIZE))) {
>+			DRM_ERROR("Failed to copy user data (%p) to drm buffer"
>+					" (%p) %dth page.\n",
>+					user_data, buf, idx);
>+			return -EFAULT;
>+
>+		}
>+	}
>+	return 0;
>+}
>+
>+EXPORT_SYMBOL(drm_buffer_copy_from_user);
>+
>+/**
>+ * Free the drm buffer object
>+ */
>+void drm_buffer_free(drm_buffer_t *buf) {
>+
>+	if (buf != NULL) {
>+
>+		int nr_pages = buf->size / PAGE_SIZE + 1;
>+		int idx;
>+		for (idx = 0; idx < nr_pages; ++idx)
>+			kfree(buf->data[idx]);
>+
>+		kfree(buf);
>+	}
>+}
>+
>+EXPORT_SYMBOL(drm_buffer_free);
>+
>+/**
>+ * Read an object from buffer that may be split to multiple parts. If object
>+ * is not split function just returns the pointer to object in buffer. But in
>+ * case of split object data is copied to given stack object that is suplied
>+ * by caller.
>+ *
>+ * The iterator of the buffer is also advanced to point the next byte after
>+ * the read object.
>+ */
>+void* drm_buffer_read_object(drm_buffer_t *buf,
>+		int objsize, void* stack_obj)
>+{
>+	int idx = drm_buffer_index(buf);
>+	int page = drm_buffer_page(buf);
>+	void *obj = 0;
>+
>+	if (idx + objsize <= PAGE_SIZE) {
>+		obj = &buf->data[page][idx];
>+	} else {
>+		/* The object is split which forces copy to temporary object.*/
>+		int beginsz = PAGE_SIZE - idx;
>+		memcpy(stack_obj, &buf->data[page][idx], beginsz);
>+
>+		memcpy(stack_obj + beginsz, &buf->data[page + 1][0],
>+				objsize - beginsz);
>+
>+		obj = stack_obj;
>+	}
>+
>+	drm_buffer_advance(buf, objsize);
>+	return obj;
>+}
>+
>+EXPORT_SYMBOL(drm_buffer_read_object);
>diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
>index 34bffa0..18d3ff8 100644
>--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
>+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
>@@ -33,6 +33,7 @@
> 
> #include "drmP.h"
> #include "drm.h"
>+#include "drm_buffer.h"
> #include "radeon_drm.h"
> #include "radeon_drv.h"
> #include "r300_reg.h"
>@@ -299,46 +300,43 @@ static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
> 	int reg;
> 	int sz;
> 	int i;
>-	int values[64];
>+	u32 *value;
> 	RING_LOCALS;
> 
> 	sz = header.packet0.count;
> 	reg = (header.packet0.reghi << 8) | header.packet0.reglo;
> 
> 	if ((sz > 64) || (sz < 0)) {
>-		DRM_ERROR
>-		    ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",
>-		     reg, sz);
>+		DRM_ERROR("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",
>+			 reg, sz);
> 		return -EINVAL;
> 	}
>+
> 	for (i = 0; i < sz; i++) {
>-		values[i] = ((int *)cmdbuf->buf)[i];
> 		switch (r300_reg_flags[(reg >> 2) + i]) {
> 		case MARK_SAFE:
> 			break;
> 		case MARK_CHECK_OFFSET:
>-			if (!radeon_check_offset(dev_priv, (u32) values[i])) {
>+			value = drm_buffer_pointer_to_dword(cmdbuf->buffer, i);
>+			if (!radeon_check_offset(dev_priv, *value)) {
> 				DRM_ERROR
>-				    ("Offset failed range check (reg=%04x sz=%d)\n",
>-				     reg, sz);
>+					("Offset failed range check (reg=%04x sz=%d)\n",
>+					 reg, sz);
> 				return -EINVAL;
> 			}
> 			break;
> 		default:
> 			DRM_ERROR("Register %04x failed check as flag=%02x\n",
>-				  reg + i * 4, r300_reg_flags[(reg >> 2) + i]);
>+					reg + i * 4, r300_reg_flags[(reg >> 2) + i]);
> 			return -EINVAL;
> 		}
> 	}
> 
> 	BEGIN_RING(1 + sz);
> 	OUT_RING(CP_PACKET0(reg, sz - 1));
>-	OUT_RING_TABLE(values, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * 4;
>-	cmdbuf->bufsz -= sz * 4;
>-
> 	return 0;
> }
> 
>@@ -362,7 +360,7 @@ static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
> 	if (!sz)
> 		return 0;
> 
>-	if (sz * 4 > cmdbuf->bufsz)
>+	if (sz * 4 > drm_buffer_unprocessed(cmdbuf->buffer))
> 		return -EINVAL;
> 
> 	if (reg + sz * 4 >= 0x10000) {
>@@ -380,12 +378,9 @@ static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
> 
> 	BEGIN_RING(1 + sz);
> 	OUT_RING(CP_PACKET0(reg, sz - 1));
>-	OUT_RING_TABLE((int *)cmdbuf->buf, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * 4;
>-	cmdbuf->bufsz -= sz * 4;
>-
> 	return 0;
> }
> 
>@@ -407,7 +402,7 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
> 
> 	if (!sz)
> 		return 0;
>-	if (sz * 16 > cmdbuf->bufsz)
>+	if (sz * 16 > drm_buffer_unprocessed(cmdbuf->buffer))
> 		return -EINVAL;
> 
> 	/* VAP is very sensitive so we purge cache before we program it
>@@ -426,7 +421,7 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
> 	BEGIN_RING(3 + sz * 4);
> 	OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr);
> 	OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1));
>-	OUT_RING_TABLE((int *)cmdbuf->buf, sz * 4);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz * 4);
> 	ADVANCE_RING();
> 
> 	BEGIN_RING(2);
>@@ -434,9 +429,6 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
> 	OUT_RING(0);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * 16;
>-	cmdbuf->bufsz -= sz * 16;
>-
> 	return 0;
> }
> 
>@@ -449,14 +441,14 @@ static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
> {
> 	RING_LOCALS;
> 
>-	if (8 * 4 > cmdbuf->bufsz)
>+	if (8 * 4 > drm_buffer_unprocessed(cmdbuf->buffer))
> 		return -EINVAL;
> 
> 	BEGIN_RING(10);
> 	OUT_RING(CP_PACKET3(R200_3D_DRAW_IMMD_2, 8));
> 	OUT_RING(R300_PRIM_TYPE_POINT | R300_PRIM_WALK_RING |
> 		 (1 << R300_PRIM_NUM_VERTICES_SHIFT));
>-	OUT_RING_TABLE((int *)cmdbuf->buf, 8);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, 8);
> 	ADVANCE_RING();
> 
> 	BEGIN_RING(4);
>@@ -468,9 +460,6 @@ static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
> 	/* set flush flag */
> 	dev_priv->track_flush |= RADEON_FLUSH_EMITED;
> 
>-	cmdbuf->buf += 8 * 4;
>-	cmdbuf->bufsz -= 8 * 4;
>-
> 	return 0;
> }
> 
>@@ -480,28 +469,29 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
> {
> 	int count, i, k;
> #define MAX_ARRAY_PACKET  64
>-	u32 payload[MAX_ARRAY_PACKET];
>+	u32 *data;
> 	u32 narrays;
> 	RING_LOCALS;
> 
>-	count = (header >> 16) & 0x3fff;
>+	count = (header & RADEON_CP_PACKET_COUNT_MASK) >> 16;
> 
> 	if ((count + 1) > MAX_ARRAY_PACKET) {
> 		DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
> 			  count);
> 		return -EINVAL;
> 	}
>-	memset(payload, 0, MAX_ARRAY_PACKET * 4);
>-	memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4);
>-
> 	/* carefully check packet contents */
> 
>-	narrays = payload[0];
>+	/* We have already read the header so advance the buffer. */
>+	drm_buffer_advance(cmdbuf->buffer, 4);
>+
>+	narrays = *(u32*)drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
> 	k = 0;
> 	i = 1;
> 	while ((k < narrays) && (i < (count + 1))) {
> 		i++;		/* skip attribute field */
>-		if (!radeon_check_offset(dev_priv, payload[i])) {
>+		data = drm_buffer_pointer_to_dword(cmdbuf->buffer, i);
>+		if (!radeon_check_offset(dev_priv, *data)) {
> 			DRM_ERROR
> 			    ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
> 			     k, i);
>@@ -512,7 +502,8 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
> 		if (k == narrays)
> 			break;
> 		/* have one more to process, they come in pairs */
>-		if (!radeon_check_offset(dev_priv, payload[i])) {
>+		data = drm_buffer_pointer_to_dword(cmdbuf->buffer, i);
>+		if (!radeon_check_offset(dev_priv, *data)) {
> 			DRM_ERROR
> 			    ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
> 			     k, i);
>@@ -533,30 +524,29 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
> 
> 	BEGIN_RING(count + 2);
> 	OUT_RING(header);
>-	OUT_RING_TABLE(payload, count + 1);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, count + 1);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += (count + 2) * 4;
>-	cmdbuf->bufsz -= (count + 2) * 4;
>-
> 	return 0;
> }
> 
> static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
> 					     drm_radeon_kcmd_buffer_t *cmdbuf)
> {
>-	u32 *cmd = (u32 *) cmdbuf->buf;
>+	u32 *cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
> 	int count, ret;
> 	RING_LOCALS;
> 
>-	count=(cmd[0]>>16) & 0x3fff;
> 
>-	if (cmd[0] & 0x8000) {
>-		u32 offset;
>+	count=(*cmd & RADEON_CP_PACKET_COUNT_MASK) >> 16;
> 
>-		if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
>+	if (*cmd & 0x8000) {
>+		u32 offset;
>+		u32 *cmd1 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
>+		if (*cmd1 & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
> 			      | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
>-			offset = cmd[2] << 10;
>+			u32 *cmd2 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 2);
>+			offset = *cmd2 << 10;
> 			ret = !radeon_check_offset(dev_priv, offset);
> 			if (ret) {
> 				DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
>@@ -564,9 +554,10 @@ static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
> 			}
> 		}
> 
>-		if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
>-		    (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
>-			offset = cmd[3] << 10;
>+		if ((*cmd1 & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
>+		    (*cmd1 & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
>+			u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
>+			offset = *cmd3 << 10;
> 			ret = !radeon_check_offset(dev_priv, offset);
> 			if (ret) {
> 				DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
>@@ -577,28 +568,25 @@ static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
> 	}
> 
> 	BEGIN_RING(count+2);
>-	OUT_RING(cmd[0]);
>-	OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, count + 2);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += (count+2)*4;
>-	cmdbuf->bufsz -= (count+2)*4;
>-
> 	return 0;
> }
> 
> static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
> 					    drm_radeon_kcmd_buffer_t *cmdbuf)
> {
>-	u32 *cmd;
>+	u32 *cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
>+	u32 *cmd1 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
> 	int count;
> 	int expected_count;
> 	RING_LOCALS;
> 
>-	cmd = (u32 *) cmdbuf->buf;
>-	count = (cmd[0]>>16) & 0x3fff;
>-	expected_count = cmd[1] >> 16;
>-	if (!(cmd[1] & R300_VAP_VF_CNTL__INDEX_SIZE_32bit))
>+	count=(*cmd & RADEON_CP_PACKET_COUNT_MASK) >> 16;
>+
>+	expected_count = *cmd1 >> 16;
>+	if (!(*cmd1 & R300_VAP_VF_CNTL__INDEX_SIZE_32bit))
> 		expected_count = (expected_count+1)/2;
> 
> 	if (count && count != expected_count) {
>@@ -608,55 +596,51 @@ static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
> 	}
> 
> 	BEGIN_RING(count+2);
>-	OUT_RING(cmd[0]);
>-	OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, count + 2);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += (count+2)*4;
>-	cmdbuf->bufsz -= (count+2)*4;
>-
> 	if (!count) {
>-		drm_r300_cmd_header_t header;
>+		drm_r300_cmd_header_t stack_header, *header;
>+		u32 *cmd1, *cmd2, *cmd3;
> 
>-		if (cmdbuf->bufsz < 4*4 + sizeof(header)) {
>+		if (drm_buffer_unprocessed(cmdbuf->buffer)
>+				< 4*4 + sizeof(stack_header)) {
> 			DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER, but stream is too short.\n");
> 			return -EINVAL;
> 		}
> 
>-		header.u = *(unsigned int *)cmdbuf->buf;
>+		header = drm_buffer_read_object(cmdbuf->buffer,
>+				sizeof(stack_header), &stack_header);
> 
>-		cmdbuf->buf += sizeof(header);
>-		cmdbuf->bufsz -= sizeof(header);
>-		cmd = (u32 *) cmdbuf->buf;
>+		cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
>+		cmd1 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
>+		cmd2 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 2);
>+		cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
> 
>-		if (header.header.cmd_type != R300_CMD_PACKET3 ||
>-		    header.packet3.packet != R300_CMD_PACKET3_RAW ||
>-		    cmd[0] != CP_PACKET3(RADEON_CP_INDX_BUFFER, 2)) {
>+		if (header->header.cmd_type != R300_CMD_PACKET3 ||
>+		    header->packet3.packet != R300_CMD_PACKET3_RAW ||
>+		    *cmd != CP_PACKET3(RADEON_CP_INDX_BUFFER, 2)) {
> 			DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER.\n");
> 			return -EINVAL;
> 		}
> 
>-		if ((cmd[1] & 0x8000ffff) != 0x80000810) {
>-			DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
>+		if ((*cmd1 & 0x8000ffff) != 0x80000810) {
>+			DRM_ERROR("Invalid indx_buffer reg address %08X\n", *cmd1);
> 			return -EINVAL;
> 		}
>-		if (!radeon_check_offset(dev_priv, cmd[2])) {
>-			DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
>+		if (!radeon_check_offset(dev_priv, *cmd2)) {
>+			DRM_ERROR("Invalid indx_buffer offset is %08X\n", *cmd2);
> 			return -EINVAL;
> 		}
>-		if (cmd[3] != expected_count) {
>+		if (*cmd3 != expected_count) {
> 			DRM_ERROR("INDX_BUFFER: buffer size %i, expected %i\n",
>-				cmd[3], expected_count);
>+				*cmd3, expected_count);
> 			return -EINVAL;
> 		}
> 
> 		BEGIN_RING(4);
>-		OUT_RING(cmd[0]);
>-		OUT_RING_TABLE((int *)(cmdbuf->buf + 4), 3);
>+		OUT_RING_DRM_BUFFER(cmdbuf->buffer, 4);
> 		ADVANCE_RING();
>-
>-		cmdbuf->buf += 4*4;
>-		cmdbuf->bufsz -= 4*4;
> 	}
> 
> 	return 0;
>@@ -665,39 +649,39 @@ static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
> static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
> 					    drm_radeon_kcmd_buffer_t *cmdbuf)
> {
>-	u32 header;
>+	u32 *header;
> 	int count;
> 	RING_LOCALS;
> 
>-	if (4 > cmdbuf->bufsz)
>+	if (4 > drm_buffer_unprocessed(cmdbuf->buffer))
> 		return -EINVAL;
> 
> 	/* Fixme !! This simply emits a packet without much checking.
> 	   We need to be smarter. */
> 
> 	/* obtain first word - actual packet3 header */
>-	header = *(u32 *) cmdbuf->buf;
>+	header = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
> 
> 	/* Is it packet 3 ? */
>-	if ((header >> 30) != 0x3) {
>-		DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
>+	if ((*header >> 30) != 0x3) {
>+		DRM_ERROR("Not a packet3 header (0x%08x)\n", *header);
> 		return -EINVAL;
> 	}
> 
>-	count = (header >> 16) & 0x3fff;
>+	count = (*header >> 16) & 0x3fff;
> 
> 	/* Check again now that we know how much data to expect */
>-	if ((count + 2) * 4 > cmdbuf->bufsz) {
>+	if ((count + 2) * 4 > drm_buffer_unprocessed(cmdbuf->buffer)) {
> 		DRM_ERROR
> 		    ("Expected packet3 of length %d but have only %d bytes left\n",
>-		     (count + 2) * 4, cmdbuf->bufsz);
>+		     (count + 2) * 4, drm_buffer_unprocessed(cmdbuf->buffer));
> 		return -EINVAL;
> 	}
> 
> 	/* Is it a packet type we know about ? */
>-	switch (header & 0xff00) {
>+	switch (*header & 0xff00) {
> 	case RADEON_3D_LOAD_VBPNTR:	/* load vertex array pointers */
>-		return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
>+		return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, *header);
> 
> 	case RADEON_CNTL_BITBLT_MULTI:
> 		return r300_emit_bitblt_multi(dev_priv, cmdbuf);
>@@ -723,18 +707,14 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
> 		/* these packets are safe */
> 		break;
> 	default:
>-		DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
>+		DRM_ERROR("Unknown packet3 header (0x%08x)\n", *header);
> 		return -EINVAL;
> 	}
> 
> 	BEGIN_RING(count + 2);
>-	OUT_RING(header);
>-	OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, count + 2);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += (count + 2) * 4;
>-	cmdbuf->bufsz -= (count + 2) * 4;
>-
> 	return 0;
> }
> 
>@@ -748,8 +728,7 @@ static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
> {
> 	int n;
> 	int ret;
>-	char *orig_buf = cmdbuf->buf;
>-	int orig_bufsz = cmdbuf->bufsz;
>+	int orig_iter = cmdbuf->buffer->iterator;
> 
> 	/* This is a do-while-loop so that we run the interior at least once,
> 	 * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
>@@ -761,8 +740,7 @@ static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
> 			if (ret)
> 				return ret;
> 
>-			cmdbuf->buf = orig_buf;
>-			cmdbuf->bufsz = orig_bufsz;
>+			cmdbuf->buffer->iterator = orig_iter;
> 		}
> 
> 		switch (header.packet3.packet) {
>@@ -785,9 +763,9 @@ static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
> 			break;
> 
> 		default:
>-			DRM_ERROR("bad packet3 type %i at %p\n",
>+			DRM_ERROR("bad packet3 type %i at byte %d\n",
> 				  header.packet3.packet,
>-				  cmdbuf->buf - sizeof(header));
>+				  cmdbuf->buffer->iterator - sizeof(header));
> 			return -EINVAL;
> 		}
> 
>@@ -923,12 +901,13 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
> 			drm_r300_cmd_header_t header)
> {
> 	u32 *ref_age_base;
>-	u32 i, buf_idx, h_pending;
>-	u64 ptr_addr;
>+	u32 i, *buf_idx, h_pending;
>+	u64 *ptr_addr;
>+	u64 stack_ptr_addr;
> 	RING_LOCALS;
> 
>-	if (cmdbuf->bufsz <
>-	    (sizeof(u64) + header.scratch.n_bufs * sizeof(buf_idx))) {
>+	if (drm_buffer_unprocessed(cmdbuf->buffer) <
>+	    (sizeof(u64) + header.scratch.n_bufs * sizeof(*buf_idx))) {
> 		return -EINVAL;
> 	}
> 
>@@ -938,21 +917,19 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
> 
> 	dev_priv->scratch_ages[header.scratch.reg]++;
> 
>-	ptr_addr = get_unaligned((u64 *)cmdbuf->buf);
>-	ref_age_base = (u32 *)(unsigned long)ptr_addr;
>-
>-	cmdbuf->buf += sizeof(u64);
>-	cmdbuf->bufsz -= sizeof(u64);
>+	ptr_addr = drm_buffer_read_object(cmdbuf->buffer,
>+			sizeof(stack_ptr_addr), &stack_ptr_addr);
>+	ref_age_base = (u32 *)(unsigned long)*ptr_addr;
> 
> 	for (i=0; i < header.scratch.n_bufs; i++) {
>-		buf_idx = *(u32 *)cmdbuf->buf;
>-		buf_idx *= 2; /* 8 bytes per buf */
>+		buf_idx = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
>+		*buf_idx *= 2; /* 8 bytes per buf */
> 
>-		if (DRM_COPY_TO_USER(ref_age_base + buf_idx, &dev_priv->scratch_ages[header.scratch.reg], sizeof(u32))) {
>+		if (DRM_COPY_TO_USER(ref_age_base + *buf_idx, &dev_priv->scratch_ages[header.scratch.reg], sizeof(u32))) {
> 			return -EINVAL;
> 		}
> 
>-		if (DRM_COPY_FROM_USER(&h_pending, ref_age_base + buf_idx + 1, sizeof(u32))) {
>+		if (DRM_COPY_FROM_USER(&h_pending, ref_age_base + *buf_idx + 1, sizeof(u32))) {
> 			return -EINVAL;
> 		}
> 
>@@ -962,12 +939,11 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
> 
> 		h_pending--;
> 
>-		if (DRM_COPY_TO_USER(ref_age_base + buf_idx + 1, &h_pending, sizeof(u32))) {
>+		if (DRM_COPY_TO_USER(ref_age_base + *buf_idx + 1, &h_pending, sizeof(u32))) {
> 			return -EINVAL;
> 		}
> 
>-		cmdbuf->buf += sizeof(buf_idx);
>-		cmdbuf->bufsz -= sizeof(buf_idx);
>+		drm_buffer_advance(cmdbuf->buffer, sizeof(*buf_idx));
> 	}
> 
> 	BEGIN_RING(2);
>@@ -1009,19 +985,16 @@ static inline int r300_emit_r500fp(drm_radeon_private_t *dev_priv,
> 	DRM_DEBUG("r500fp %d %d type: %d\n", sz, addr, type);
> 	if (!sz)
> 		return 0;
>-	if (sz * stride * 4 > cmdbuf->bufsz)
>+	if (sz * stride * 4 > drm_buffer_unprocessed(cmdbuf->buffer))
> 		return -EINVAL;
> 
> 	BEGIN_RING(3 + sz * stride);
> 	OUT_RING_REG(R500_GA_US_VECTOR_INDEX, addr);
> 	OUT_RING(CP_PACKET0_TABLE(R500_GA_US_VECTOR_DATA, sz * stride - 1));
>-	OUT_RING_TABLE((int *)cmdbuf->buf, sz * stride);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz * stride);
> 
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * stride * 4;
>-	cmdbuf->bufsz -= sz * stride * 4;
>-
> 	return 0;
> }
> 
>@@ -1053,19 +1026,17 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 			goto cleanup;
> 	}
> 
>-	while (cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
>+	while (drm_buffer_unprocessed(cmdbuf->buffer) >= sizeof(drm_r300_cmd_header_t)) {
> 		int idx;
>-		drm_r300_cmd_header_t header;
>-
>-		header.u = *(unsigned int *)cmdbuf->buf;
>+		drm_r300_cmd_header_t *header, stack_header;
> 
>-		cmdbuf->buf += sizeof(header);
>-		cmdbuf->bufsz -= sizeof(header);
>+		header = drm_buffer_read_object(cmdbuf->buffer,
>+				sizeof(stack_header), &stack_header);
> 
>-		switch (header.header.cmd_type) {
>+		switch (header->header.cmd_type) {
> 		case R300_CMD_PACKET0:
> 			DRM_DEBUG("R300_CMD_PACKET0\n");
>-			ret = r300_emit_packet0(dev_priv, cmdbuf, header);
>+			ret = r300_emit_packet0(dev_priv, cmdbuf, *header);
> 			if (ret) {
> 				DRM_ERROR("r300_emit_packet0 failed\n");
> 				goto cleanup;
>@@ -1074,7 +1045,7 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 
> 		case R300_CMD_VPU:
> 			DRM_DEBUG("R300_CMD_VPU\n");
>-			ret = r300_emit_vpu(dev_priv, cmdbuf, header);
>+			ret = r300_emit_vpu(dev_priv, cmdbuf, *header);
> 			if (ret) {
> 				DRM_ERROR("r300_emit_vpu failed\n");
> 				goto cleanup;
>@@ -1083,7 +1054,7 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 
> 		case R300_CMD_PACKET3:
> 			DRM_DEBUG("R300_CMD_PACKET3\n");
>-			ret = r300_emit_packet3(dev_priv, cmdbuf, header);
>+			ret = r300_emit_packet3(dev_priv, cmdbuf, *header);
> 			if (ret) {
> 				DRM_ERROR("r300_emit_packet3 failed\n");
> 				goto cleanup;
>@@ -1117,8 +1088,8 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 				int i;
> 				RING_LOCALS;
> 
>-				BEGIN_RING(header.delay.count);
>-				for (i = 0; i < header.delay.count; i++)
>+				BEGIN_RING(header->delay.count);
>+				for (i = 0; i < header->delay.count; i++)
> 					OUT_RING(RADEON_CP_PACKET2);
> 				ADVANCE_RING();
> 			}
>@@ -1126,7 +1097,7 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 
> 		case R300_CMD_DMA_DISCARD:
> 			DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
>-			idx = header.dma.buf_idx;
>+			idx = header->dma.buf_idx;
> 			if (idx < 0 || idx >= dma->buf_count) {
> 				DRM_ERROR("buffer index %d (of %d max)\n",
> 					  idx, dma->buf_count - 1);
>@@ -1149,12 +1120,12 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 
> 		case R300_CMD_WAIT:
> 			DRM_DEBUG("R300_CMD_WAIT\n");
>-			r300_cmd_wait(dev_priv, header);
>+			r300_cmd_wait(dev_priv, *header);
> 			break;
> 
> 		case R300_CMD_SCRATCH:
> 			DRM_DEBUG("R300_CMD_SCRATCH\n");
>-			ret = r300_scratch(dev_priv, cmdbuf, header);
>+			ret = r300_scratch(dev_priv, cmdbuf, *header);
> 			if (ret) {
> 				DRM_ERROR("r300_scratch failed\n");
> 				goto cleanup;
>@@ -1168,16 +1139,16 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
> 				goto cleanup;
> 			}
> 			DRM_DEBUG("R300_CMD_R500FP\n");
>-			ret = r300_emit_r500fp(dev_priv, cmdbuf, header);
>+			ret = r300_emit_r500fp(dev_priv, cmdbuf, *header);
> 			if (ret) {
> 				DRM_ERROR("r300_emit_r500fp failed\n");
> 				goto cleanup;
> 			}
> 			break;
> 		default:
>-			DRM_ERROR("bad cmd_type %i at %p\n",
>-				  header.header.cmd_type,
>-				  cmdbuf->buf - sizeof(header));
>+			DRM_ERROR("bad cmd_type %i at byte %d\n",
>+				  header->header.cmd_type,
>+				  cmdbuf->buffer->iterator - sizeof(*header));
> 			ret = -EINVAL;
> 			goto cleanup;
> 		}
>diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
>index e137852..f742253 100644
>--- a/drivers/gpu/drm/radeon/radeon_drv.h
>+++ b/drivers/gpu/drm/radeon/radeon_drv.h
>@@ -309,9 +309,11 @@ typedef struct drm_radeon_buf_priv {
> 	u32 age;
> } drm_radeon_buf_priv_t;
> 
>+struct drm_buffer;
>+
> typedef struct drm_radeon_kcmd_buffer {
> 	int bufsz;
>-	char *buf;
>+	struct drm_buffer *buffer;
> 	int nbox;
> 	struct drm_clip_rect __user *boxes;
> } drm_radeon_kcmd_buffer_t;
>@@ -2121,4 +2123,32 @@ extern void radeon_commit_ring(drm_radeon_private_t *dev_priv);
> 	write &= mask;						\
> } while (0)
> 
>+/**
>+ * Copy given number of dwords from drm buffer to the ring buffer.
>+ */
>+#define OUT_RING_DRM_BUFFER( buf, sz ) do {				\
>+	int _size = (sz) * 4;						\
>+	drm_buffer_t *_buf = (buf);					\
>+	int _part_size;							\
>+	while (_size > 0) {						\
>+		_part_size = _size;					\
>+									\
>+		if (write + _part_size/4 > mask)			\
>+			_part_size = ((mask + 1) - write)*4;		\
>+									\
>+		if (drm_buffer_index(_buf) + _part_size > PAGE_SIZE)	\
>+			_part_size = PAGE_SIZE - drm_buffer_index(_buf);\
>+									\
>+		BUG_ON(_part_size & 0x3);				\
>+									\
>+		memcpy(ring + write, &_buf->data[drm_buffer_page(_buf)]	\
>+			[drm_buffer_index(_buf)], _part_size);		\
>+									\
>+		_size -= _part_size;					\
>+		write = (write + _part_size/4) & mask;			\
>+		drm_buffer_advance(_buf, _part_size);			\
>+	}								\
>+} while(0);
>+
>+
> #endif				/* __RADEON_DRV_H__ */
>diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
>index 067167c..2a75be3 100644
>--- a/drivers/gpu/drm/radeon/radeon_state.c
>+++ b/drivers/gpu/drm/radeon/radeon_state.c
>@@ -29,6 +29,7 @@
> 
> #include "drmP.h"
> #include "drm.h"
>+#include "drm_buffer.h"
> #include "drm_sarea.h"
> #include "radeon_drm.h"
> #include "radeon_drv.h"
>@@ -91,21 +92,26 @@ static __inline__ int radeon_check_and_fixup_offset(drm_radeon_private_t *
> static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
> 						     dev_priv,
> 						     struct drm_file *file_priv,
>-						     int id, u32 *data)
>+						     int id, drm_buffer_t *buf)
> {
>+	u32 *data;
> 	switch (id) {
> 
> 	case RADEON_EMIT_PP_MISC:
>-		if (radeon_check_and_fixup_offset(dev_priv, file_priv,
>-		    &data[(RADEON_RB3D_DEPTHOFFSET - RADEON_PP_MISC) / 4])) {
>+		data = drm_buffer_pointer_to_dword(buf,
>+			(RADEON_RB3D_DEPTHOFFSET - RADEON_PP_MISC) / 4);
>+
>+		if (radeon_check_and_fixup_offset(dev_priv, file_priv, data)) {
> 			DRM_ERROR("Invalid depth buffer offset\n");
> 			return -EINVAL;
> 		}
> 		break;
> 
> 	case RADEON_EMIT_PP_CNTL:
>-		if (radeon_check_and_fixup_offset(dev_priv, file_priv,
>-		    &data[(RADEON_RB3D_COLOROFFSET - RADEON_PP_CNTL) / 4])) {
>+		data = drm_buffer_pointer_to_dword(buf,
>+			(RADEON_RB3D_COLOROFFSET - RADEON_PP_CNTL) / 4);
>+
>+		if (radeon_check_and_fixup_offset(dev_priv, file_priv, data)) {
> 			DRM_ERROR("Invalid colour buffer offset\n");
> 			return -EINVAL;
> 		}
>@@ -117,8 +123,8 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
> 	case R200_EMIT_PP_TXOFFSET_3:
> 	case R200_EMIT_PP_TXOFFSET_4:
> 	case R200_EMIT_PP_TXOFFSET_5:
>-		if (radeon_check_and_fixup_offset(dev_priv, file_priv,
>-						  &data[0])) {
>+		data = drm_buffer_pointer_to_dword(buf, 0);
>+		if (radeon_check_and_fixup_offset(dev_priv, file_priv, data)) {
> 			DRM_ERROR("Invalid R200 texture offset\n");
> 			return -EINVAL;
> 		}
>@@ -127,8 +133,9 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
> 	case RADEON_EMIT_PP_TXFILTER_0:
> 	case RADEON_EMIT_PP_TXFILTER_1:
> 	case RADEON_EMIT_PP_TXFILTER_2:
>-		if (radeon_check_and_fixup_offset(dev_priv, file_priv,
>-		    &data[(RADEON_PP_TXOFFSET_0 - RADEON_PP_TXFILTER_0) / 4])) {
>+		data = drm_buffer_pointer_to_dword(buf,
>+			(RADEON_PP_TXOFFSET_0 - RADEON_PP_TXFILTER_0) / 4);
>+		if (radeon_check_and_fixup_offset(dev_priv, file_priv, data)) {
> 			DRM_ERROR("Invalid R100 texture offset\n");
> 			return -EINVAL;
> 		}
>@@ -142,9 +149,10 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
> 	case R200_EMIT_PP_CUBIC_OFFSETS_5:{
> 			int i;
> 			for (i = 0; i < 5; i++) {
>+				data = drm_buffer_pointer_to_dword(buf, i);
> 				if (radeon_check_and_fixup_offset(dev_priv,
> 								  file_priv,
>-								  &data[i])) {
>+								  data)) {
> 					DRM_ERROR
> 					    ("Invalid R200 cubic texture offset\n");
> 					return -EINVAL;
>@@ -158,9 +166,10 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
> 	case RADEON_EMIT_PP_CUBIC_OFFSETS_T2:{
> 			int i;
> 			for (i = 0; i < 5; i++) {
>+				data = drm_buffer_pointer_to_dword(buf, i);
> 				if (radeon_check_and_fixup_offset(dev_priv,
> 								  file_priv,
>-								  &data[i])) {
>+								  data)) {
> 					DRM_ERROR
> 					    ("Invalid R100 cubic texture offset\n");
> 					return -EINVAL;
>@@ -269,23 +278,24 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 						     cmdbuf,
> 						     unsigned int *cmdsz)
> {
>-	u32 *cmd = (u32 *) cmdbuf->buf;
>+	u32 *cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
> 	u32 offset, narrays;
> 	int count, i, k;
> 
>-	*cmdsz = 2 + ((cmd[0] & RADEON_CP_PACKET_COUNT_MASK) >> 16);
>+	count = ((*cmd & RADEON_CP_PACKET_COUNT_MASK) >> 16);
>+	*cmdsz = 2 + count;
> 
>-	if ((cmd[0] & 0xc0000000) != RADEON_CP_PACKET3) {
>+	if ((*cmd & 0xc0000000) != RADEON_CP_PACKET3) {
> 		DRM_ERROR("Not a type 3 packet\n");
> 		return -EINVAL;
> 	}
> 
>-	if (4 * *cmdsz > cmdbuf->bufsz) {
>+	if (4 * *cmdsz > drm_buffer_unprocessed(cmdbuf->buffer)) {
> 		DRM_ERROR("Packet size larger than size of data provided\n");
> 		return -EINVAL;
> 	}
> 
>-	switch(cmd[0] & 0xff00) {
>+	switch(*cmd & 0xff00) {
> 	/* XXX Are there old drivers needing other packets? */
> 
> 	case RADEON_3D_DRAW_IMMD:
>@@ -312,7 +322,6 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 		break;
> 
> 	case RADEON_3D_LOAD_VBPNTR:
>-		count = (cmd[0] >> 16) & 0x3fff;
> 
> 		if (count > 18) { /* 12 arrays max */
> 			DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
>@@ -321,13 +330,16 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 		}
> 
> 		/* carefully check packet contents */
>-		narrays = cmd[1] & ~0xc000;
>+		cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
>+
>+		narrays = *cmd & ~0xc000;
> 		k = 0;
> 		i = 2;
> 		while ((k < narrays) && (i < (count + 2))) {
> 			i++;		/* skip attribute field */
>+			cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, i);
> 			if (radeon_check_and_fixup_offset(dev_priv, file_priv,
>-							  &cmd[i])) {
>+							  cmd)) {
> 				DRM_ERROR
> 				    ("Invalid offset (k=%d i=%d) in 3D_LOAD_VBPNTR packet.\n",
> 				     k, i);
>@@ -338,8 +350,10 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 			if (k == narrays)
> 				break;
> 			/* have one more to process, they come in pairs */
>+			cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, i);
>+
> 			if (radeon_check_and_fixup_offset(dev_priv,
>-							  file_priv, &cmd[i]))
>+							  file_priv, cmd))
> 			{
> 				DRM_ERROR
> 				    ("Invalid offset (k=%d i=%d) in 3D_LOAD_VBPNTR packet.\n",
>@@ -363,7 +377,9 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 			DRM_ERROR("Invalid 3d packet for r200-class chip\n");
> 			return -EINVAL;
> 		}
>-		if (radeon_check_and_fixup_offset(dev_priv, file_priv, &cmd[1])) {
>+
>+		cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
>+		if (radeon_check_and_fixup_offset(dev_priv, file_priv, cmd)) {
> 				DRM_ERROR("Invalid rndr_gen_indx offset\n");
> 				return -EINVAL;
> 		}
>@@ -374,12 +390,15 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 			DRM_ERROR("Invalid 3d packet for r100-class chip\n");
> 			return -EINVAL;
> 		}
>-		if ((cmd[1] & 0x8000ffff) != 0x80000810) {
>-			DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
>+
>+		cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
>+		if ((*cmd & 0x8000ffff) != 0x80000810) {
>+			DRM_ERROR("Invalid indx_buffer reg address %08X\n", *cmd);
> 			return -EINVAL;
> 		}
>-		if (radeon_check_and_fixup_offset(dev_priv, file_priv, &cmd[2])) {
>-			DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
>+		cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 2);
>+		if (radeon_check_and_fixup_offset(dev_priv, file_priv, cmd)) {
>+			DRM_ERROR("Invalid indx_buffer offset is %08X\n", *cmd);
> 			return -EINVAL;
> 		}
> 		break;
>@@ -388,31 +407,34 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
> 	case RADEON_CNTL_PAINT_MULTI:
> 	case RADEON_CNTL_BITBLT_MULTI:
> 		/* MSB of opcode: next DWORD GUI_CNTL */
>-		if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
>+		cmd = drm_buffer_pointer_to_dword(cmdbuf->buffer, 1);
>+		if (*cmd & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
> 			      | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
>-			offset = cmd[2] << 10;
>+			u32 *cmd2 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 2);
>+			offset = *cmd2 << 10;
> 			if (radeon_check_and_fixup_offset
> 			    (dev_priv, file_priv, &offset)) {
> 				DRM_ERROR("Invalid first packet offset\n");
> 				return -EINVAL;
> 			}
>-			cmd[2] = (cmd[2] & 0xffc00000) | offset >> 10;
>+			*cmd2 = (*cmd2 & 0xffc00000) | offset >> 10;
> 		}
> 
>-		if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
>-		    (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
>-			offset = cmd[3] << 10;
>+		if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
>+		    (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
>+			u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
>+			offset = *cmd << 10;
> 			if (radeon_check_and_fixup_offset
> 			    (dev_priv, file_priv, &offset)) {
> 				DRM_ERROR("Invalid second packet offset\n");
> 				return -EINVAL;
> 			}
>-			cmd[3] = (cmd[3] & 0xffc00000) | offset >> 10;
>+			*cmd3 = (*cmd3 & 0xffc00000) | offset >> 10;
> 		}
> 		break;
> 
> 	default:
>-		DRM_ERROR("Invalid packet type %x\n", cmd[0] & 0xff00);
>+		DRM_ERROR("Invalid packet type %x\n", *cmd & 0xff00);
> 		return -EINVAL;
> 	}
> 
>@@ -2611,7 +2633,6 @@ static int radeon_emit_packets(drm_radeon_private_t * dev_priv,
> {
> 	int id = (int)header.packet.packet_id;
> 	int sz, reg;
>-	int *data = (int *)cmdbuf->buf;
> 	RING_LOCALS;
> 
> 	if (id >= RADEON_MAX_STATE_PACKETS)
>@@ -2620,23 +2641,22 @@ static int radeon_emit_packets(drm_radeon_private_t * dev_priv,
> 	sz = packet[id].len;
> 	reg = packet[id].start;
> 
>-	if (sz * sizeof(int) > cmdbuf->bufsz) {
>+	if (sz * sizeof(u32) > drm_buffer_unprocessed(cmdbuf->buffer)) {
> 		DRM_ERROR("Packet size provided larger than data provided\n");
> 		return -EINVAL;
> 	}
> 
>-	if (radeon_check_and_fixup_packets(dev_priv, file_priv, id, data)) {
>+	if (radeon_check_and_fixup_packets(dev_priv, file_priv, id,
>+				cmdbuf->buffer)) {
> 		DRM_ERROR("Packet verification failed\n");
> 		return -EINVAL;
> 	}
> 
> 	BEGIN_RING(sz + 1);
> 	OUT_RING(CP_PACKET0(reg, (sz - 1)));
>-	OUT_RING_TABLE(data, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * sizeof(int);
>-	cmdbuf->bufsz -= sz * sizeof(int);
> 	return 0;
> }
> 
>@@ -2653,10 +2673,8 @@ static __inline__ int radeon_emit_scalars(drm_radeon_private_t *dev_priv,
> 	OUT_RING(CP_PACKET0(RADEON_SE_TCL_SCALAR_INDX_REG, 0));
> 	OUT_RING(start | (stride << RADEON_SCAL_INDX_DWORD_STRIDE_SHIFT));
> 	OUT_RING(CP_PACKET0_TABLE(RADEON_SE_TCL_SCALAR_DATA_REG, sz - 1));
>-	OUT_RING_TABLE(cmdbuf->buf, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
>-	cmdbuf->buf += sz * sizeof(int);
>-	cmdbuf->bufsz -= sz * sizeof(int);
> 	return 0;
> }
> 
>@@ -2675,10 +2693,8 @@ static __inline__ int radeon_emit_scalars2(drm_radeon_private_t *dev_priv,
> 	OUT_RING(CP_PACKET0(RADEON_SE_TCL_SCALAR_INDX_REG, 0));
> 	OUT_RING(start | (stride << RADEON_SCAL_INDX_DWORD_STRIDE_SHIFT));
> 	OUT_RING(CP_PACKET0_TABLE(RADEON_SE_TCL_SCALAR_DATA_REG, sz - 1));
>-	OUT_RING_TABLE(cmdbuf->buf, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
>-	cmdbuf->buf += sz * sizeof(int);
>-	cmdbuf->bufsz -= sz * sizeof(int);
> 	return 0;
> }
> 
>@@ -2696,11 +2712,9 @@ static __inline__ int radeon_emit_vectors(drm_radeon_private_t *dev_priv,
> 	OUT_RING(CP_PACKET0(RADEON_SE_TCL_VECTOR_INDX_REG, 0));
> 	OUT_RING(start | (stride << RADEON_VEC_INDX_OCTWORD_STRIDE_SHIFT));
> 	OUT_RING(CP_PACKET0_TABLE(RADEON_SE_TCL_VECTOR_DATA_REG, (sz - 1)));
>-	OUT_RING_TABLE(cmdbuf->buf, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * sizeof(int);
>-	cmdbuf->bufsz -= sz * sizeof(int);
> 	return 0;
> }
> 
>@@ -2714,7 +2728,7 @@ static __inline__ int radeon_emit_veclinear(drm_radeon_private_t *dev_priv,
> 
>         if (!sz)
>                 return 0;
>-        if (sz * 4 > cmdbuf->bufsz)
>+        if (sz * 4 > drm_buffer_unprocessed(cmdbuf->buffer))
>                 return -EINVAL;
> 
> 	BEGIN_RING(5 + sz);
>@@ -2722,11 +2736,9 @@ static __inline__ int radeon_emit_veclinear(drm_radeon_private_t *dev_priv,
> 	OUT_RING(CP_PACKET0(RADEON_SE_TCL_VECTOR_INDX_REG, 0));
> 	OUT_RING(start | (1 << RADEON_VEC_INDX_OCTWORD_STRIDE_SHIFT));
> 	OUT_RING(CP_PACKET0_TABLE(RADEON_SE_TCL_VECTOR_DATA_REG, (sz - 1)));
>-	OUT_RING_TABLE(cmdbuf->buf, sz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, sz);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += sz * sizeof(int);
>-	cmdbuf->bufsz -= sz * sizeof(int);
> 	return 0;
> }
> 
>@@ -2748,11 +2760,9 @@ static int radeon_emit_packet3(struct drm_device * dev,
> 	}
> 
> 	BEGIN_RING(cmdsz);
>-	OUT_RING_TABLE(cmdbuf->buf, cmdsz);
>+	OUT_RING_DRM_BUFFER(cmdbuf->buffer, cmdsz);
> 	ADVANCE_RING();
> 
>-	cmdbuf->buf += cmdsz * 4;
>-	cmdbuf->bufsz -= cmdsz * 4;
> 	return 0;
> }
> 
>@@ -2805,16 +2815,16 @@ static int radeon_emit_packet3_cliprect(struct drm_device *dev,
> 		}
> 
> 		BEGIN_RING(cmdsz);
>-		OUT_RING_TABLE(cmdbuf->buf, cmdsz);
>+		OUT_RING_DRM_BUFFER(cmdbuf->buffer, cmdsz);
> 		ADVANCE_RING();
> 
> 	} while (++i < cmdbuf->nbox);
> 	if (cmdbuf->nbox == 1)
> 		cmdbuf->nbox = 0;
> 
>+	return 0;
>       out:
>-	cmdbuf->buf += cmdsz * 4;
>-	cmdbuf->bufsz -= cmdsz * 4;
>+	drm_buffer_advance(cmdbuf->buffer, cmdsz * 4);
> 	return 0;
> }
> 
>@@ -2847,16 +2857,16 @@ static int radeon_emit_wait(struct drm_device * dev, int flags)
> 	return 0;
> }
> 
>-static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_priv)
>+static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
>+		struct drm_file *file_priv)
> {
> 	drm_radeon_private_t *dev_priv = dev->dev_private;
> 	struct drm_device_dma *dma = dev->dma;
> 	struct drm_buf *buf = NULL;
>+	drm_radeon_cmd_header_t stack_header;
> 	int idx;
> 	drm_radeon_kcmd_buffer_t *cmdbuf = data;
>-	drm_radeon_cmd_header_t header;
>-	int orig_nbox, orig_bufsz;
>-	char *kbuf = NULL;
>+	int orig_nbox;
> 
> 	LOCK_TEST_WITH_RETURN(dev, file_priv);
> 
>@@ -2871,17 +2881,14 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 	 * races between checking values and using those values in other code,
> 	 * and simply to avoid a lot of function calls to copy in data.
> 	 */
>-	orig_bufsz = cmdbuf->bufsz;
>-	if (orig_bufsz != 0) {
>-		kbuf = kmalloc(cmdbuf->bufsz, GFP_KERNEL);
>-		if (kbuf == NULL)
>-			return -ENOMEM;
>-		if (DRM_COPY_FROM_USER(kbuf, (void __user *)cmdbuf->buf,
>-				       cmdbuf->bufsz)) {
>-			kfree(kbuf);
>-			return -EFAULT;
>-		}
>-		cmdbuf->buf = kbuf;
>+	if (cmdbuf->bufsz != 0) {
>+		int rv;
>+		void __user *buffer = cmdbuf->buffer;
>+		if ((rv = drm_buffer_alloc(&cmdbuf->buffer, cmdbuf->bufsz)))
>+			return rv;
>+		if ((rv = drm_buffer_copy_from_user(cmdbuf->buffer,buffer,
>+						cmdbuf->bufsz)))
>+			return rv;
> 	}
> 
> 	orig_nbox = cmdbuf->nbox;
>@@ -2890,24 +2897,24 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 		int temp;
> 		temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
> 
>-		if (orig_bufsz != 0)
>-			kfree(kbuf);
>+		if (cmdbuf->bufsz != 0)
>+			drm_buffer_free(cmdbuf->buffer);
> 
> 		return temp;
> 	}
> 
> 	/* microcode_version != r300 */
>-	while (cmdbuf->bufsz >= sizeof(header)) {
>+	while (drm_buffer_unprocessed(cmdbuf->buffer) >= sizeof(stack_header)) {
> 
>-		header.i = *(int *)cmdbuf->buf;
>-		cmdbuf->buf += sizeof(header);
>-		cmdbuf->bufsz -= sizeof(header);
>+		drm_radeon_cmd_header_t *header;
>+		header = drm_buffer_read_object(cmdbuf->buffer,
>+				sizeof(stack_header), &stack_header);
> 
>-		switch (header.header.cmd_type) {
>+		switch (header->header.cmd_type) {
> 		case RADEON_CMD_PACKET:
> 			DRM_DEBUG("RADEON_CMD_PACKET\n");
> 			if (radeon_emit_packets
>-			    (dev_priv, file_priv, header, cmdbuf)) {
>+			    (dev_priv, file_priv, *header, cmdbuf)) {
> 				DRM_ERROR("radeon_emit_packets failed\n");
> 				goto err;
> 			}
>@@ -2915,7 +2922,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 
> 		case RADEON_CMD_SCALARS:
> 			DRM_DEBUG("RADEON_CMD_SCALARS\n");
>-			if (radeon_emit_scalars(dev_priv, header, cmdbuf)) {
>+			if (radeon_emit_scalars(dev_priv, *header, cmdbuf)) {
> 				DRM_ERROR("radeon_emit_scalars failed\n");
> 				goto err;
> 			}
>@@ -2923,7 +2930,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 
> 		case RADEON_CMD_VECTORS:
> 			DRM_DEBUG("RADEON_CMD_VECTORS\n");
>-			if (radeon_emit_vectors(dev_priv, header, cmdbuf)) {
>+			if (radeon_emit_vectors(dev_priv, *header, cmdbuf)) {
> 				DRM_ERROR("radeon_emit_vectors failed\n");
> 				goto err;
> 			}
>@@ -2931,7 +2938,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 
> 		case RADEON_CMD_DMA_DISCARD:
> 			DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
>-			idx = header.dma.buf_idx;
>+			idx = header->dma.buf_idx;
> 			if (idx < 0 || idx >= dma->buf_count) {
> 				DRM_ERROR("buffer index %d (of %d max)\n",
> 					  idx, dma->buf_count - 1);
>@@ -2968,7 +2975,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 
> 		case RADEON_CMD_SCALARS2:
> 			DRM_DEBUG("RADEON_CMD_SCALARS2\n");
>-			if (radeon_emit_scalars2(dev_priv, header, cmdbuf)) {
>+			if (radeon_emit_scalars2(dev_priv, *header, cmdbuf)) {
> 				DRM_ERROR("radeon_emit_scalars2 failed\n");
> 				goto err;
> 			}
>@@ -2976,37 +2983,37 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data, struct drm_file
> 
> 		case RADEON_CMD_WAIT:
> 			DRM_DEBUG("RADEON_CMD_WAIT\n");
>-			if (radeon_emit_wait(dev, header.wait.flags)) {
>+			if (radeon_emit_wait(dev, header->wait.flags)) {
> 				DRM_ERROR("radeon_emit_wait failed\n");
> 				goto err;
> 			}
> 			break;
> 		case RADEON_CMD_VECLINEAR:
> 			DRM_DEBUG("RADEON_CMD_VECLINEAR\n");
>-			if (radeon_emit_veclinear(dev_priv, header, cmdbuf)) {
>+			if (radeon_emit_veclinear(dev_priv, *header, cmdbuf)) {
> 				DRM_ERROR("radeon_emit_veclinear failed\n");
> 				goto err;
> 			}
> 			break;
> 
> 		default:
>-			DRM_ERROR("bad cmd_type %d at %p\n",
>-				  header.header.cmd_type,
>-				  cmdbuf->buf - sizeof(header));
>+			DRM_ERROR("bad cmd_type %d at byte %d\n",
>+				  header->header.cmd_type,
>+				  cmdbuf->buffer->iterator);
> 			goto err;
> 		}
> 	}
> 
>-	if (orig_bufsz != 0)
>-		kfree(kbuf);
>+	if (cmdbuf->bufsz != 0)
>+		drm_buffer_free(cmdbuf->buffer);
> 
> 	DRM_DEBUG("DONE\n");
> 	COMMIT_RING();
> 	return 0;
> 
>       err:
>-	if (orig_bufsz != 0)
>-		kfree(kbuf);
>+	if (cmdbuf->bufsz != 0)
>+		drm_buffer_free(cmdbuf->buffer);
> 	return -EINVAL;
> }
> 
>diff --git a/include/drm/drm_buffer.h b/include/drm/drm_buffer.h
>new file mode 100644
>index 0000000..02eb4a3
>--- /dev/null
>+++ b/include/drm/drm_buffer.h
>@@ -0,0 +1,133 @@
>+/**************************************************************************
>+ *
>+ * Copyright 2010 Pauli Nieminen.
>+ * All Rights Reserved.
>+ *
>+ * Permission is hereby granted, free of charge, to any person obtaining a
>+ * copy of this software and associated documentation files (the
>+ * "Software"), to deal in the Software without restriction, including
>+ * without limitation the rights to use, copy, modify, merge, publish,
>+ * distribute, sub license, and/or sell copies of the Software, and to
>+ * permit persons to whom the Software is furnished to do so, subject to
>+ * the following conditions:
>+ *
>+ * The above copyright notice and this permission notice (including the
>+ * next paragraph) shall be included in all copies or substantial portions
>+ * of the Software.
>+ *
>+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
>+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
>+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
>+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
>+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
>+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
>+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
>+ *
>+ *
>+ **************************************************************************/
>+/*
>+ * Multipart buffer for coping and holding large user space arrays.
>+ *
>+ * Authors:
>+ * Pauli Nieminen <suokkos-at-gmail-dot-com>
>+ */
>+
>+#ifndef _DRM_BUFFER_H_
>+#define _DRM_BUFFER_H_
>+
>+#include "drmP.h"
>+
>+typedef struct drm_buffer {
>+	int iterator;
>+	int size;
>+	char *data[];
>+} drm_buffer_t;
>+
>+
>+/**
>+ * Return the index of page that buffer is currently pointing at.
>+ */
>+static inline int drm_buffer_page(drm_buffer_t *buf)
>+{
>+	return buf->iterator / PAGE_SIZE;
>+}
>+/**
>+ * Return the index of the current byte in the page
>+ */
>+static inline int drm_buffer_index(drm_buffer_t *buf)
>+{
>+	return buf->iterator & (PAGE_SIZE - 1);
>+}
>+/**
>+ * Return number of bytes that is left to process
>+ */
>+static inline int drm_buffer_unprocessed(drm_buffer_t *buf)
>+{
>+	return buf->size - buf->iterator;
>+}
>+
>+/**
>+ * Advance the buffer iterator number of bytes that is given.
>+ */
>+static inline void drm_buffer_advance(drm_buffer_t *buf, int bytes)
>+{
>+	buf->iterator += bytes;
>+}
>+
>+/**
>+ * Allocate the drm buffer object to hold size bytes.
>+ */
>+extern int drm_buffer_alloc(drm_buffer_t **buf, int size);
>+
>+/**
>+ * Copy the user data to the begin of the buffer and reset the processing
>+ * iterator.
>+ */
>+extern int drm_buffer_copy_from_user(drm_buffer_t *buf,
>+		void __user *user_data, int size);
>+
>+/**
>+ * Free the drm buffer object
>+ */
>+extern void drm_buffer_free(drm_buffer_t *buf);
>+
>+/**
>+ * Read an object from buffer that may be split to multiple parts. If object
>+ * is not split function just returns the pointer to object in buffer. But in
>+ * case of split object data is copied to given stack object that is suplied
>+ * by caller.
>+ *
>+ * The processing location of the buffer is also advanced to the next byte
>+ * after the object.
>+ */
>+extern void* drm_buffer_read_object(drm_buffer_t *buf,
>+		int objsize, void* stack_obj);
>+
>+/**
>+ * Returns the pointer to the dword which is offset number of elements from the
>+ * current processing location.
>+ *
>+ * Caller must make sure that dword is not split in the buffer. This
>+ * requirement is easily met if all the sizes of objects in buffer are
>+ * multiples of dword and PAGE_SIZE is multiple dword.
>+ *
>+ * Call to this function doesn't change the processing location.
>+ */
>+static inline void* drm_buffer_pointer_to_dword(drm_buffer_t* buffer, int offset)
>+{
>+	int iter = buffer->iterator + offset * 4;
>+	return &buffer->data[iter / PAGE_SIZE][iter & (PAGE_SIZE - 1)];
>+}
>+/**
>+ * Returns the pointer to the dword which is offset number of elements from
>+ * the current processing location.
>+ *
>+ * Call to this function doesn't change the processing location.
>+ */
>+static inline void* drm_buffer_pointer_to_byte(drm_buffer_t* buffer, int offset)
>+{
>+	int iter = buffer->iterator + offset;
>+	return &buffer->data[iter / PAGE_SIZE][iter & (PAGE_SIZE - 1)];
>+}
>+
>+#endif

Actions: View | Splinter Review

Attachments on bug 23993: 29633 | 29634 | 32755 | 32756 | 32763 | 32899 | 32963 | 32964

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.