summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Kiszka <jan.kiszka@web.de>2010-01-24 09:51:49 +0100
committerAnthony Liguori <aliguori@us.ibm.com>2010-01-26 16:20:20 -0600
commiteb05143e244fb7abb720a1fd1c90d5317125e023 (patch)
tree4c4ee6225db53d64b93b5637738bea43b92593f7
parentMusicpal: Fix wm8750 I2C address (diff)
downloadqemu-kvm-eb05143e244fb7abb720a1fd1c90d5317125e023.tar.gz
qemu-kvm-eb05143e244fb7abb720a1fd1c90d5317125e023.tar.bz2
qemu-kvm-eb05143e244fb7abb720a1fd1c90d5317125e023.zip
Musicpal: Fix descriptor walk in eth_send
Commit 930c86820e introduced a regression to eth_send: eth_tx_desc_put manipulates the host's tx descriptor copy before writing it back, but two lines down the descriptor is evaluated again, leaving us with an invalid next address if host and guest endianness differ. So this was the actual issue commit 2e87c5b937 tried to paper over. Signed-off-by: Jan Kiszka <jan.kiszka@web.de> Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit 07b064e9de65a26a4cb36dfb37c7506ef17407fd) Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
-rw-r--r--hw/musicpal.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/hw/musicpal.c b/hw/musicpal.c
index e424a7de3..b8af15ed5 100644
--- a/hw/musicpal.c
+++ b/hw/musicpal.c
@@ -238,14 +238,13 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index)
{
uint32_t desc_addr = s->tx_queue[queue_index];
mv88w8618_tx_desc desc;
+ uint32_t next_desc;
uint8_t buf[2048];
int len;
- if (!desc_addr) {
- return;
- }
do {
eth_tx_desc_get(desc_addr, &desc);
+ next_desc = desc.next;
if (desc.cmdstat & MP_ETH_TX_OWN) {
len = desc.bytes;
if (len < 2048) {
@@ -256,7 +255,7 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index)
s->icr |= 1 << (MP_ETH_IRQ_TXLO_BIT - queue_index);
eth_tx_desc_put(desc_addr, &desc);
}
- desc_addr = desc.next;
+ desc_addr = next_desc;
} while (desc_addr != s->tx_queue[queue_index]);
}