From 305706980267dae191d0fca2c769d7a31011be14 Mon Sep 17 00:00:00 2001 From: Peter Crosthwaite Date: Tue, 3 Dec 2013 21:59:43 -0800 Subject: net/cadence_gem: Fix rx multi-fragment packets Bytes_to_copy was being updated before its final use where it advances the rx buffer pointer. This was causing total mayhem, where packet data for any subsequent fragments was being fetched from the wrong place. Reported-by: Deepika Dhamija Signed-off-by: Peter Crosthwaite Reviewed-by: Peter Maydell Message-id: c2a1c65c1fd06eb274442a0fa4a6839d940e145e.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell --- hw/net/cadence_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'hw/net') diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c index 8cfad04017..2afafdfb2b 100644 --- a/hw/net/cadence_gem.c +++ b/hw/net/cadence_gem.c @@ -733,8 +733,8 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size) /* Copy packet data to emulated DMA buffer */ cpu_physical_memory_write(rx_desc_get_buffer(s->rx_desc) + rxbuf_offset, rxbuf_ptr, MIN(bytes_to_copy, rxbufsize)); - bytes_to_copy -= MIN(bytes_to_copy, rxbufsize); rxbuf_ptr += MIN(bytes_to_copy, rxbufsize); + bytes_to_copy -= MIN(bytes_to_copy, rxbufsize); /* Update the descriptor. */ if (first_desc) { -- cgit v1.2.1