From 60202efbb5750ae9233035d45a5cb5acb6e03d38 Mon Sep 17 00:00:00 2001 From: Jan Kiszka Date: Sun, 24 Jan 2010 09:51:49 +0100 Subject: [PATCH] Musicpal: Fix descriptor walk in eth_send Commit 930c86820e introduced a regression to eth_send: eth_tx_desc_put manipulates the host's tx descriptor copy before writing it back, but two lines down the descriptor is evaluated again, leaving us with an invalid next address if host and guest endianness differ. So this was the actual issue commit 2e87c5b937 tried to paper over. Signed-off-by: Jan Kiszka Signed-off-by: malc --- hw/musicpal.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/musicpal.c b/hw/musicpal.c index e424a7d..b8af15e 100644 --- a/hw/musicpal.c +++ b/hw/musicpal.c @@ -238,14 +238,13 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index) { uint32_t desc_addr = s->tx_queue[queue_index]; mv88w8618_tx_desc desc; + uint32_t next_desc; uint8_t buf[2048]; int len; - if (!desc_addr) { - return; - } do { eth_tx_desc_get(desc_addr, &desc); + next_desc = desc.next; if (desc.cmdstat & MP_ETH_TX_OWN) { len = desc.bytes; if (len < 2048) { @@ -256,7 +255,7 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index) s->icr |= 1 << (MP_ETH_IRQ_TXLO_BIT - queue_index); eth_tx_desc_put(desc_addr, &desc); } - desc_addr = desc.next; + desc_addr = next_desc; } while (desc_addr != s->tx_queue[queue_index]); } -- 2.7.4