905 		const drm_savage_cmd_header_t *cmdbuf;  in savage_dispatch_draw()  local
908 		cmdbuf = start;  in savage_dispatch_draw()
909 		while (cmdbuf < end) {  in savage_dispatch_draw()
911 			cmd_header = *cmdbuf;  in savage_dispatch_draw()
912 			cmdbuf++;  in savage_dispatch_draw()
927 					&cmd_header, (const uint16_t *)cmdbuf,  in savage_dispatch_draw()
929 				cmdbuf += j;  in savage_dispatch_draw()
935 					&cmd_header, (const uint16_t *)cmdbuf,  in savage_dispatch_draw()
938 				cmdbuf += j;  in savage_dispatch_draw()
961 	drm_savage_cmdbuf_t *cmdbuf = data;  in savage_bci_cmdbuf()  local
974 		if (cmdbuf->dma_idx >= dma->buf_count) {  in savage_bci_cmdbuf()
977 			     cmdbuf->dma_idx, dma->buf_count - 1);  in savage_bci_cmdbuf()
980 		dmabuf = dma->buflist[cmdbuf->dma_idx];  in savage_bci_cmdbuf()
990 	if (cmdbuf->size) {  in savage_bci_cmdbuf()
991 		kcmd_addr = kmalloc_array(cmdbuf->size, 8, GFP_KERNEL);  in savage_bci_cmdbuf()
995 		if (copy_from_user(kcmd_addr, cmdbuf->cmd_addr,  in savage_bci_cmdbuf()
996 				       cmdbuf->size * 8))  in savage_bci_cmdbuf()
1001 		cmdbuf->cmd_addr = kcmd_addr;  in savage_bci_cmdbuf()
1003 	if (cmdbuf->vb_size) {  in savage_bci_cmdbuf()
1004 		kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size);  in savage_bci_cmdbuf()
1010 		cmdbuf->vb_addr = kvb_addr;  in savage_bci_cmdbuf()
1012 	if (cmdbuf->nbox) {  in savage_bci_cmdbuf()
1013 		kbox_addr = kmalloc_array(cmdbuf->nbox, sizeof(struct drm_clip_rect),  in savage_bci_cmdbuf()
1020 		if (copy_from_user(kbox_addr, cmdbuf->box_addr,  in savage_bci_cmdbuf()
1021 				       cmdbuf->nbox * sizeof(struct drm_clip_rect))) {  in savage_bci_cmdbuf()
1025 	cmdbuf->box_addr = kbox_addr;  in savage_bci_cmdbuf()
1038 	while (i < cmdbuf->size) {  in savage_bci_cmdbuf()
1040 		cmd_header = *(drm_savage_cmd_header_t *)cmdbuf->cmd_addr;  in savage_bci_cmdbuf()
1041 		cmdbuf->cmd_addr++;  in savage_bci_cmdbuf()
1051 			if (i + j > cmdbuf->size) {  in savage_bci_cmdbuf()
1062 				first_draw_cmd = cmdbuf->cmd_addr - 1;  in savage_bci_cmdbuf()
1063 			cmdbuf->cmd_addr += j;  in savage_bci_cmdbuf()
1070 				      cmdbuf->cmd_addr - 1,  in savage_bci_cmdbuf()
1071 				      dmabuf, cmdbuf->vb_addr, cmdbuf->vb_size,  in savage_bci_cmdbuf()
1072 				      cmdbuf->vb_stride,  in savage_bci_cmdbuf()
1073 				      cmdbuf->nbox, cmdbuf->box_addr);  in savage_bci_cmdbuf()
1085 			if (i + j > cmdbuf->size) {  in savage_bci_cmdbuf()
1093 				(const uint32_t *)cmdbuf->cmd_addr);  in savage_bci_cmdbuf()
1094 			cmdbuf->cmd_addr += j;  in savage_bci_cmdbuf()
1098 			if (i + 1 > cmdbuf->size) {  in savage_bci_cmdbuf()
1106 						    cmdbuf->cmd_addr,  in savage_bci_cmdbuf()
1107 						    cmdbuf->nbox,  in savage_bci_cmdbuf()
1108 						    cmdbuf->box_addr);  in savage_bci_cmdbuf()
1109 			cmdbuf->cmd_addr++;  in savage_bci_cmdbuf()
1113 			ret = savage_dispatch_swap(dev_priv, cmdbuf->nbox,  in savage_bci_cmdbuf()
1114 						   cmdbuf->box_addr);  in savage_bci_cmdbuf()
1132 			dev_priv, first_draw_cmd, cmdbuf->cmd_addr, dmabuf,  in savage_bci_cmdbuf()
1133 			cmdbuf->vb_addr, cmdbuf->vb_size, cmdbuf->vb_stride,  in savage_bci_cmdbuf()
1134 			cmdbuf->nbox, cmdbuf->box_addr);  in savage_bci_cmdbuf()
1143 	if (dmabuf && cmdbuf->discard) {  in savage_bci_cmdbuf()