int pcbit_writecmd(const u_char __user *buf, int len, int driver, int channel) 
static int pcbit_writecmd(const u_char __user *buf, int len, int driver, int channel) 
int pcbit_writecmd(const u_char __user *buf, int len, int driver, int channel){	struct pcbit_dev * dev;	int i, j;	const u_char * loadbuf;	u_char * ptr = NULL;	u_char *cbuf;	int errstat;	dev = finddev(driver);	if (!dev)	{		printk("pcbit_writecmd: couldn't find device");		return -ENODEV;	}	switch(dev->l2_state) {	case L2_LWMODE:		/* check (size <= rdp_size); write buf into board */		if (len < 0 || len > BANK4 + 1 || len > 1024)		{			printk("pcbit_writecmd: invalid length %d\n", len);			return -EINVAL;		}		cbuf = kmalloc(len, GFP_KERNEL);		if (!cbuf)			return -ENOMEM;		if (copy_from_user(cbuf, buf, len)) {			kfree(cbuf);			return -EFAULT;		}		memcpy_toio(dev->sh_mem, cbuf, len);		kfree(cbuf);		return len;	case L2_FWMODE:		/* this is the hard part */		/* dumb board */		/* get it into kernel space */		if ((ptr = kmalloc(len, GFP_KERNEL))==NULL)			return -ENOMEM;		if (copy_from_user(ptr, buf, len)) {			kfree(ptr);			return -EFAULT;		}		loadbuf = ptr;    		errstat = 0;		for (i=0; i < len; i++)		{			for(j=0; j < LOAD_RETRY; j++)				if (!(readb(dev->sh_mem + dev->loadptr)))					break;			if (j == LOAD_RETRY)			{				errstat = -ETIME;				printk("TIMEOUT i=%d\n", i);				break;			}			writeb(loadbuf[i], dev->sh_mem + dev->loadptr + 1);			writeb(0x01, dev->sh_mem + dev->loadptr);			dev->loadptr += 2;			if (dev->loadptr > LOAD_ZONE_END)				dev->loadptr = LOAD_ZONE_START;		}		kfree(ptr);		return errstat ? errstat : len;	default:		return -EBUSY;	}}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/886cca3a0fda659e17c730c20929134014ebe1f2/drv.c/buggy/drivers/isdn/pcbit/drv.c