From a3ffd793f1a3c545744a2707bdcdde30d5ef8462 Mon Sep 17 00:00:00 2001
From: Arend van Spriel <arend@broadcom.com>
Date: Fri, 21 Oct 2011 16:16:35 +0200
Subject: [PATCH] --- yaml --- r: 277639 b: refs/heads/master c:
 028f78d43d80dcb8b1142ea38606067151dd3d51 h: refs/heads/master i:   277637:
 a9a14d5569b8e924077b8fe54d59a41e4b173b14   277635:
 b37df438dd0d9814eb3099ad24301b9aeb16cc83   277631:
 b209814002690828abbe1cb63872970f83a5b0bb v: v3

---
 [refs]                                        |  2 +-
 .../net/wireless/brcm80211/brcmsmac/srom.c    | 33 +++++++++----------
 2 files changed, 16 insertions(+), 19 deletions(-)

diff --git a/[refs] b/[refs]
index 39b848fabcd6..f8f1d7c64ab9 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d1a5b6fbecc52323acf05fa7881267071933c92e
+refs/heads/master: 028f78d43d80dcb8b1142ea38606067151dd3d51
diff --git a/trunk/drivers/net/wireless/brcm80211/brcmsmac/srom.c b/trunk/drivers/net/wireless/brcm80211/brcmsmac/srom.c
index 8f1cf2f733e5..0539a6a831c5 100644
--- a/trunk/drivers/net/wireless/brcm80211/brcmsmac/srom.c
+++ b/trunk/drivers/net/wireless/brcm80211/brcmsmac/srom.c
@@ -617,18 +617,16 @@ static uint mask_width(u16 mask)
 	return 0;
 }
 
-static inline void le16_to_cpu_buf(u16 *buf, unsigned int size)
+static inline void le16_to_cpu_buf(u16 *buf, uint nwords)
 {
-	size /= 2;
-	while (size--)
-		*(buf + size) = le16_to_cpu(*(__le16 *)(buf + size));
+	while (nwords--)
+		*(buf + nwords) = le16_to_cpu(*(__le16 *)(buf + nwords));
 }
 
-static inline void cpu_to_le16_buf(u16 *buf, unsigned int size)
+static inline void cpu_to_le16_buf(u16 *buf, uint nwords)
 {
-	size /= 2;
-	while (size--)
-		*(__le16 *)(buf + size) = cpu_to_le16(*(buf + size));
+	while (nwords--)
+		*(__le16 *)(buf + nwords) = cpu_to_le16(*(buf + nwords));
 }
 
 /*
@@ -807,12 +805,12 @@ sprom_read_pci(struct si_pub *sih, u8 __iomem *sprom, uint wordoff,
 		err = -EIO;
 	else
 		/* now correct the endianness of the byte array */
-		le16_to_cpu_buf(buf, nbytes);
+		le16_to_cpu_buf(buf, nwords);
 
 	return err;
 }
 
-static int otp_read_pci(struct si_pub *sih, u16 *buf, uint bufsz)
+static int otp_read_pci(struct si_pub *sih, u16 *buf, uint nwords)
 {
 	u8 *otp;
 	uint sz = OTP_SZ_MAX / 2;	/* size in words */
@@ -824,7 +822,8 @@ static int otp_read_pci(struct si_pub *sih, u16 *buf, uint bufsz)
 
 	err = otp_read_region(sih, OTP_HW_RGN, (u16 *) otp, &sz);
 
-	memcpy(buf, otp, bufsz);
+	sz = min_t(uint, sz, nwords);
+	memcpy(buf, otp, sz * 2);
 
 	kfree(otp);
 
@@ -836,14 +835,12 @@ static int otp_read_pci(struct si_pub *sih, u16 *buf, uint bufsz)
 		 */
 		return -ENODATA;
 
-	/* fixup the endianness so crc8 will pass */
-	cpu_to_le16_buf(buf, bufsz);
-	if (crc8(brcms_srom_crc8_table, (u8 *) buf, SROM4_WORDS * 2,
+	if (crc8(brcms_srom_crc8_table, (u8 *) buf, sz * 2,
 		 CRC8_INIT_VALUE) != CRC8_GOOD_VALUE(brcms_srom_crc8_table))
 		err = -EIO;
-
-	/* now correct the endianness of the byte array */
-	le16_to_cpu_buf(buf, bufsz);
+	else
+		/* now correct the endianness of the byte array */
+		le16_to_cpu_buf(buf, sz);
 
 	return err;
 }
@@ -880,7 +877,7 @@ static int initvars_srom_pci(struct si_pub *sih, void __iomem *curmap)
 			sromrev = srom[SROM4_CRCREV] & 0xff;
 	} else {
 		/* Use OTP if SPROM not available */
-		err = otp_read_pci(sih, srom, SROM_MAX);
+		err = otp_read_pci(sih, srom, SROM4_WORDS);
 		if (err == 0)
 			/* OTP only contain SROM rev8/rev9 for now */
 			sromrev = srom[SROM4_CRCREV] & 0xff;