native_size = (__force __be32 *) (buf + 2); count = be32_to_cpu(*native_size); 
count = be32_to_cpu(*((__be32 *) (buf + 2))); 
static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,			    size_t bufsiz){	ssize_t len;	u32 count;	__be32 *native_size;	unsigned long stop;	native_size = (__force __be32 *) (buf + 2);	count = be32_to_cpu(*native_size);	if (count == 0)		return -ENODATA;	if (count > bufsiz) {		dev_err(&chip->pci_dev->dev,			"invalid count value %x %zx \n", count, bufsiz);		return -E2BIG;	}	down(&chip->tpm_mutex);	if ((len = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {		dev_err(&chip->pci_dev->dev,			"tpm_transmit: tpm_send: error %zd\n", len);		return len;	}	stop = jiffies + 2 * 60 * HZ;	do {		u8 status = inb(chip->vendor->base + 1);		if ((status & chip->vendor->req_complete_mask) ==		    chip->vendor->req_complete_val) {			goto out_recv;		}		msleep(TPM_TIMEOUT); /* CHECK */		rmb();	} while (time_before(jiffies, stop));	chip->vendor->cancel(chip);	dev_err(&chip->pci_dev->dev, "Time expired\n");	up(&chip->tpm_mutex);	return -EIO;out_recv:	len = chip->vendor->recv(chip, (u8 *) buf, bufsiz);	if (len < 0)		dev_err(&chip->pci_dev->dev,			"tpm_transmit: tpm_recv: error %zd\n", len);	up(&chip->tpm_mutex);	return len;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/81179bb6a54c2c626b4cbcc084ca974bb2d7f2a3/tpm.c/buggy/drivers/char/tpm/tpm.c