905 		const drm_savage_cmd_header_t *cmdbuf;  in savage_dispatch_draw()  local
908 		cmdbuf = start;  in savage_dispatch_draw()
909 		while (cmdbuf < end) {  in savage_dispatch_draw()
911 			cmd_header = *cmdbuf;  in savage_dispatch_draw()
912 			cmdbuf++;  in savage_dispatch_draw()
927 					&cmd_header, (const uint16_t *)cmdbuf,  in savage_dispatch_draw()
929 				cmdbuf += j;  in savage_dispatch_draw()
935 					&cmd_header, (const uint16_t *)cmdbuf,  in savage_dispatch_draw()
938 				cmdbuf += j;  in savage_dispatch_draw()
961 	drm_savage_cmdbuf_t *cmdbuf = data;  in savage_bci_cmdbuf()  local
974 		if (cmdbuf->dma_idx > dma->buf_count) {  in savage_bci_cmdbuf()
977 			     cmdbuf->dma_idx, dma->buf_count - 1);  in savage_bci_cmdbuf()
980 		dmabuf = dma->buflist[cmdbuf->dma_idx];  in savage_bci_cmdbuf()
990 	if (cmdbuf->size) {  in savage_bci_cmdbuf()
991 		kcmd_addr = kmalloc_array(cmdbuf->size, 8, GFP_KERNEL);  in savage_bci_cmdbuf()
995 		if (copy_from_user(kcmd_addr, cmdbuf->cmd_addr,  in savage_bci_cmdbuf()
996 				       cmdbuf->size * 8))  in savage_bci_cmdbuf()
1001 		cmdbuf->cmd_addr = kcmd_addr;  in savage_bci_cmdbuf()
1003 	if (cmdbuf->vb_size) {  in savage_bci_cmdbuf()
1004 		kvb_addr = kmalloc(cmdbuf->vb_size, GFP_KERNEL);  in savage_bci_cmdbuf()
1010 		if (copy_from_user(kvb_addr, cmdbuf->vb_addr,  in savage_bci_cmdbuf()
1011 				       cmdbuf->vb_size)) {  in savage_bci_cmdbuf()
1015 		cmdbuf->vb_addr = kvb_addr;  in savage_bci_cmdbuf()
1017 	if (cmdbuf->nbox) {  in savage_bci_cmdbuf()
1018 		kbox_addr = kmalloc_array(cmdbuf->nbox, sizeof(struct drm_clip_rect),  in savage_bci_cmdbuf()
1025 		if (copy_from_user(kbox_addr, cmdbuf->box_addr,  in savage_bci_cmdbuf()
1026 				       cmdbuf->nbox * sizeof(struct drm_clip_rect))) {  in savage_bci_cmdbuf()
1030 	cmdbuf->box_addr = kbox_addr;  in savage_bci_cmdbuf()
1043 	while (i < cmdbuf->size) {  in savage_bci_cmdbuf()
1045 		cmd_header = *(drm_savage_cmd_header_t *)cmdbuf->cmd_addr;  in savage_bci_cmdbuf()
1046 		cmdbuf->cmd_addr++;  in savage_bci_cmdbuf()
1056 			if (i + j > cmdbuf->size) {  in savage_bci_cmdbuf()
1067 				first_draw_cmd = cmdbuf->cmd_addr - 1;  in savage_bci_cmdbuf()
1068 			cmdbuf->cmd_addr += j;  in savage_bci_cmdbuf()
1075 				      cmdbuf->cmd_addr - 1,  in savage_bci_cmdbuf()
1076 				      dmabuf, cmdbuf->vb_addr, cmdbuf->vb_size,  in savage_bci_cmdbuf()
1077 				      cmdbuf->vb_stride,  in savage_bci_cmdbuf()
1078 				      cmdbuf->nbox, cmdbuf->box_addr);  in savage_bci_cmdbuf()
1090 			if (i + j > cmdbuf->size) {  in savage_bci_cmdbuf()
1098 				(const uint32_t *)cmdbuf->cmd_addr);  in savage_bci_cmdbuf()
1099 			cmdbuf->cmd_addr += j;  in savage_bci_cmdbuf()
1103 			if (i + 1 > cmdbuf->size) {  in savage_bci_cmdbuf()
1111 						    cmdbuf->cmd_addr,  in savage_bci_cmdbuf()
1112 						    cmdbuf->nbox,  in savage_bci_cmdbuf()
1113 						    cmdbuf->box_addr);  in savage_bci_cmdbuf()
1114 			cmdbuf->cmd_addr++;  in savage_bci_cmdbuf()
1118 			ret = savage_dispatch_swap(dev_priv, cmdbuf->nbox,  in savage_bci_cmdbuf()
1119 						   cmdbuf->box_addr);  in savage_bci_cmdbuf()
1137 			dev_priv, first_draw_cmd, cmdbuf->cmd_addr, dmabuf,  in savage_bci_cmdbuf()
1138 			cmdbuf->vb_addr, cmdbuf->vb_size, cmdbuf->vb_stride,  in savage_bci_cmdbuf()
1139 			cmdbuf->nbox, cmdbuf->box_addr);  in savage_bci_cmdbuf()
1148 	if (dmabuf && cmdbuf->discard) {  in savage_bci_cmdbuf()