1 files changed, 6 insertions, 4 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl-testmode.c b/drivers/net/wireless/iwlwifi/iwl-testmode.c
index 5f00a3712707..ba5c63a023a2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-testmode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-testmode.c
@@ -799,9 +799,10 @@ static int iwl_testmode_indirect_read(struct iwl_priv *priv, u32 addr, u32 size)
                 addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
                         spin_lock_irqsave(&trans->reg_lock, flags);
                         iwl_grab_nic_access(trans);
-                        iwl_write32(trans, HBUS_TARG_PRPH_RADDR, addr);
+                        iwl_write32(trans, HBUS_TARG_PRPH_RADDR,
+                                addr | (3 << 24));
                         for (i = 0; i < size; i += 4)
-                                priv->testmode_mem.buff_addr[i] =
+                                *(u32 *)(priv->testmode_mem.buff_addr + i) =
                                         iwl_read32(trans, HBUS_TARG_PRPH_RDAT);
                         iwl_release_nic_access(trans);
                         spin_unlock_irqrestore(&trans->reg_lock, flags);
@@ -833,7 +834,8 @@ static int iwl_testmode_indirect_write(struct iwl_priv *priv, u32 addr,
                                 spin_lock_irqsave(&trans->reg_lock, flags);
                                 iwl_grab_nic_access(trans);
                                 iwl_write32(trans, HBUS_TARG_PRPH_WADDR,
-                                            (addr & 0x0000FFFF) | (size << 24));
+                                            (addr & 0x0000FFFF) |
+                                            ((size - 1) << 24));
                                 iwl_write32(trans, HBUS_TARG_PRPH_WDAT, val);
                                 iwl_release_nic_access(trans);
                                 /* needed after consecutive writes w/o read */
@@ -844,7 +846,7 @@ static int iwl_testmode_indirect_write(struct iwl_priv *priv, u32 addr,
                                         return -EINVAL;
                                 for (i = 0; i < size; i += 4)
                                         iwl_write_prph(trans, addr+i,
-                                                *(u32 *)buf+i);
+                                                *(u32 *)(buf+i));
                         }
         } else if (iwlagn_hw_valid_rtc_data_addr(addr) ||
                 (IWLAGN_RTC_INST_LOWER_BOUND <= addr &&