Index: r300_cmdbuf.c
===================================================================
RCS file: /cvs/dri/drm/shared-core/r300_cmdbuf.c,v
retrieving revision 1.2
diff -u -b -B -u -r1.2 r300_cmdbuf.c
--- r300_cmdbuf.c	28 Jul 2005 01:44:17 -0000	1.2
+++ r300_cmdbuf.c	6 Oct 2005 18:18:53 -0000
@@ -764,6 +764,63 @@
 				ADVANCE_RING();
 			}
 			break;
+		case R300_CMD_SCRATCH:
+			{
+				u32 *age_base, *age_ptr;
+				u32 age;
+				u32 i, buf_idx;
+				RING_LOCALS;
+				
+				DRM_DEBUG("R300_CMD_SCRATCH\n");
+				
+				if(cmdbuf->bufsz < 2 * sizeof(u32 *) + header.scratch.n_bufs * sizeof(buf_idx)){
+					ret = DRM_ERR(EINVAL);
+					goto cleanup;
+				}
+				
+				age_ptr = *((u32 **)cmdbuf->buf);
+				if(DRM_COPY_FROM_USER(&age, age_ptr, sizeof(u32))){
+					ret = DRM_ERR(EINVAL);
+					goto cleanup;
+				}
+				
+				cmdbuf->buf += sizeof(u32 *);
+				cmdbuf->bufsz -= sizeof(u32 *);
+				
+				if(header.scratch.reg > 5){
+					ret = DRM_ERR(EINVAL);
+					goto cleanup;
+				}
+				
+				age++;
+				
+				age_base = *((u32 **)cmdbuf->buf);
+				
+				cmdbuf->buf += sizeof(u32 *);
+				cmdbuf->bufsz -= sizeof(u32 *);
+						
+				
+				for(i=0; i < header.scratch.n_bufs; i++){
+					buf_idx = *((u32 *)cmdbuf->buf);
+					if(DRM_COPY_TO_USER(age_base + buf_idx, &age, sizeof(u32))){
+						ret = DRM_ERR(EINVAL);
+						goto cleanup;
+					}
+					cmdbuf->buf += sizeof(buf_idx);
+					cmdbuf->bufsz -= sizeof(buf_idx);
+				}
+				
+				BEGIN_RING(2);
+				OUT_RING( CP_PACKET0( RADEON_SCRATCH_REG0 + header.scratch.reg * 4, 0 ) );
+				OUT_RING( age );
+				ADVANCE_RING();
+						
+				if(DRM_COPY_TO_USER(age_ptr, &age, sizeof(u32))){
+					ret = DRM_ERR(EINVAL);
+					goto cleanup;
+				}
+			}
+			break;
 
 		default:
 			DRM_ERROR("bad cmd_type %i at %p\n",
Index: radeon_drm.h
===================================================================
RCS file: /cvs/dri/drm/shared-core/radeon_drm.h,v
retrieving revision 1.34
diff -u -b -B -u -r1.34 radeon_drm.h
--- radeon_drm.h	30 Sep 2005 06:35:09 -0000	1.34
+++ radeon_drm.h	6 Oct 2005 18:18:54 -0000
@@ -222,6 +222,7 @@
 #	define R300_WAIT_3D  		0x2
 #	define R300_WAIT_2D_CLEAN  	0x3
 #	define R300_WAIT_3D_CLEAN  	0x4
+#define R300_CMD_SCRATCH		8
 
 typedef union {
 	unsigned int u;
@@ -247,6 +248,9 @@
 	struct {
 		unsigned char cmd_type, flags, pad0, pad1;	
 	} wait;
+	struct {
+		unsigned char cmd_type, reg, n_bufs, flags;
+	} scratch;
 } drm_r300_cmd_header_t;
 
 #define RADEON_FRONT			0x1