File ipxe-gcc6-858f56e6.patch of Package xen

--- /dev/null
+++ b/tools/firmware/etherboot/patches/ath9k-Fix-buffer-overrun-for-ar9287.patch
@@ -0,0 +1,48 @@
+From 858f56e68b7089a3dc8473bb94dd198554a24eeb Mon Sep 17 00:00:00 2001
+From: Christian Hesse <mail@eworm.de>
+Date: Sat, 7 May 2016 21:20:37 +0200
+Subject: [ath9k] Fix buffer overrun for ar9287
+
+This backport is from linux kernel upstream commit 83d6f1f ("ath9k:
+fix buffer overrun for ar9287").
+
+Signed-off-by: Christian Hesse <mail@eworm.de>
+Signed-off-by: Michael Brown <mcb30@ipxe.org>
+---
+ src/drivers/net/ath/ath9k/ath9k_eeprom.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/src/drivers/net/ath/ath9k/ath9k_eeprom.c b/src/drivers/net/ath/ath9k/ath9k_eeprom.c
+index f552aca..a204237 100644
+--- a/src/drivers/net/ath/ath9k/ath9k_eeprom.c
++++ b/src/drivers/net/ath/ath9k/ath9k_eeprom.c
+@@ -368,10 +368,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ 
+ 	if (match) {
+ 		if (AR_SREV_9287(ah)) {
+-			/* FIXME: array overrun? */
+ 			for (i = 0; i < numXpdGains; i++) {
+ 				minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
+-				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
++				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
+ 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ 						data_9287[idxL].pwrPdg[i],
+ 						data_9287[idxL].vpdPdg[i],
+@@ -381,7 +380,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ 		} else if (eeprom_4k) {
+ 			for (i = 0; i < numXpdGains; i++) {
+ 				minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
+-				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
++				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
+ 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ 						data_4k[idxL].pwrPdg[i],
+ 						data_4k[idxL].vpdPdg[i],
+@@ -391,7 +390,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ 		} else {
+ 			for (i = 0; i < numXpdGains; i++) {
+ 				minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
+-				maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
++				maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
+ 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ 						data_def[idxL].pwrPdg[i],
+ 						data_def[idxL].vpdPdg[i],
--- a/tools/firmware/etherboot/patches/series
+++ b/tools/firmware/etherboot/patches/series
@@ -10,3 +10,4 @@ sis190-Fix-building-with-GCC-6.patch
 skge-Fix-building-with-GCC-6.patch
 ath-Fix-building-with-GCC-6.patch
 ethernet-Expose-eth_broadcast-as-a-global-constant.patch
+ath9k-Fix-buffer-overrun-for-ar9287.patch