3 @@ -495,9 +495,9 @@ wl_iw_get_range(
6 struct iw_range *range = (struct iw_range *) extra;
7 - int channels[MAXCHANNEL+1];
8 - wl_uint32_list_t *list = (wl_uint32_list_t *) channels;
9 - wl_rateset_t rateset;
11 + wl_uint32_list_t *list;
12 + wl_rateset_t *rateset;
16 @@ -506,6 +506,17 @@ wl_iw_get_range(
20 + channels = kcalloc(MAXCHANNEL+1, sizeof(*channels), GFP_KERNEL);
23 + list = (wl_uint32_list_t *) channels;
25 + rateset = kzalloc(sizeof(*rateset), GFP_KERNEL);
31 dwrq->length = sizeof(struct iw_range);
32 memset(range, 0, sizeof(range));
34 @@ -514,8 +525,9 @@ wl_iw_get_range(
36 /* Set available channels/frequencies */
37 list->count = htod32(MAXCHANNEL);
38 - if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, sizeof(channels))))
40 + if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels,
41 + (MAXCHANNEL+1) * sizeof(*channels))))
43 for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
44 range->freq[i].i = dtoh32(list->element[i]);
46 @@ -549,19 +561,19 @@ wl_iw_get_range(
47 #endif /* WIRELESS_EXT > 11 */
49 /* Set available bitrates */
50 - if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
52 - rateset.count = dtoh32(rateset.count);
53 - range->num_bitrates = rateset.count;
54 - for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
55 - range->bitrate[i] = (rateset.rates[i] & 0x7f) * 500000; /* convert to bps */
56 + if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, rateset, sizeof(*rateset))))
58 + rateset->count = dtoh32(rateset->count);
59 + range->num_bitrates = rateset->count;
60 + for (i = 0; i < rateset->count && i < IW_MAX_BITRATES; i++)
61 + range->bitrate[i] = (rateset->rates[i] & 0x7f) * 500000; /* convert to bps */
63 /* Set an indication of the max TCP throughput
64 * in bit/s that we can expect using this interface.
65 * May be use for QoS stuff... Jean II
67 if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i))))
71 if (i == WLC_PHY_TYPE_A)
72 range->throughput = 24000000; /* 24 Mbits/s */
73 @@ -624,7 +636,12 @@ wl_iw_get_range(
75 #endif /* WIRELESS_EXT > 17 */
87 --- a/driver/bcmsrom.c
88 +++ b/driver/bcmsrom.c
89 @@ -437,20 +437,37 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
90 uint byteoff, uint nbytes, uint16 *buf)
92 uint i, nw, crc_range;
93 - uint16 old[SROM_MAXW], new[SROM_MAXW];
96 volatile uint32 val32;
99 ASSERT(bustype == BUSTYPE(bustype));
101 + old = MALLOC(osh, SROM_MAXW);
102 + ASSERT(old != NULL);
106 + new = MALLOC(osh, SROM_MAXW);
107 + ASSERT(new != NULL);
113 /* check input - 16-bit access only. use byteoff 0x55aa to indicate
116 - if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1)))
118 + if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1))) {
123 - if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX))
125 + if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX)) {
130 if (BUSTYPE(bustype) == PCMCIA_BUS) {
131 crc_range = SROM_MAX;
132 @@ -467,8 +484,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
135 /* read first small number words from srom, then adjust the length, read all */
136 - if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
138 + if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
143 BS_ERROR(("%s: old[SROM4_SIGN] 0x%x, old[SROM8_SIGN] 0x%x\n",
144 __FUNCTION__, old[SROM4_SIGN], old[SROM8_SIGN]));
145 @@ -481,10 +500,13 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
146 __FUNCTION__, buf[SROM4_SIGN], buf[SROM8_SIGN]));
148 /* block invalid buffer size */
149 - if (nbytes < SROM4_WORDS * 2)
150 - return BCME_BUFTOOSHORT;
151 - else if (nbytes > SROM4_WORDS * 2)
152 - return BCME_BUFTOOLONG;
153 + if (nbytes < SROM4_WORDS * 2) {
154 + rc = BCME_BUFTOOSHORT;
156 + } else if (nbytes > SROM4_WORDS * 2) {
157 + rc = BCME_BUFTOOLONG;
162 } else if (nbytes == SROM_WORDS * 2){ /* the other possible SROM format */
163 @@ -493,17 +515,22 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
166 BS_ERROR(("%s: Invalid input file signature\n", __FUNCTION__));
167 - return BCME_BADARG;
172 - if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
174 + if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
178 } else if ((old[SROM4_SIGN] == SROM4_SIGNATURE) ||
179 (old[SROM8_SIGN] == SROM4_SIGNATURE)) {
182 - if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
184 + if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
189 /* Assert that we have already read enough for sromrev 2 */
190 ASSERT(crc_range >= SROM_WORDS * 2);
191 @@ -562,8 +589,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
193 } else if (BUSTYPE(bustype) == PCMCIA_BUS) {
194 /* enable writes to the SPROM */
195 - if (sprom_cmd_pcmcia(osh, SROM_WEN))
197 + if (sprom_cmd_pcmcia(osh, SROM_WEN)) {
201 bcm_mdelay(WRITE_ENABLE_DELAY);
203 for (i = 0; i < nw; i++) {
204 @@ -573,14 +602,15 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
207 /* disable writes to the SPROM */
208 - if (sprom_cmd_pcmcia(osh, SROM_WDS))
210 + if (sprom_cmd_pcmcia(osh, SROM_WDS)) {
214 } else if (BUSTYPE(bustype) == SI_BUS) {
215 #if defined(BCMUSBDEV)
216 if (SPROMBUS == PCMCIA_BUS) {
222 origidx = si_coreidx(sih);
223 @@ -596,16 +626,24 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
224 si_core_disable(sih, 0);
226 si_setcoreidx(sih, origidx);
240 bcm_mdelay(WRITE_ENABLE_DELAY);
245 + MFREE(osh, new, SROM_MAXW);
247 + MFREE(osh, old, SROM_MAXW);
251 #if defined(BCMUSBDEV)
252 --- a/driver/linux_osl.c
253 +++ b/driver/linux_osl.c
254 @@ -600,20 +600,29 @@ int
255 osl_printf(const char *format, ...)
262 + buf = kcalloc(1024, sizeof(*buf), GFP_KERNEL);
266 /* sprintf into a local buffer because there *is* no "vprintk()".. */
267 va_start(args, format);
268 len = vsnprintf(buf, 1024, format, args);
271 - if (len > sizeof(buf)) {
272 + if (len > (sizeof(*buf) * 1024)) {
273 printk("osl_printf: buffer overrun\n");
278 - return (printk(buf));
288 --- a/driver/bcmutils.c
289 +++ b/driver/bcmutils.c
292 #include <typedefs.h>
294 +#define __need___va_list
296 #include <bcmutils.h>