From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47953) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fRNf0-0007gj-Cg for qemu-devel@nongnu.org; Fri, 08 Jun 2018 16:07:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fRNez-0006sc-ES for qemu-devel@nongnu.org; Fri, 08 Jun 2018 16:06:58 -0400 From: Laurent Vivier Date: Fri, 8 Jun 2018 22:05:55 +0200 Message-Id: <20180608200558.386-11-laurent@vivier.eu> In-Reply-To: <20180608200558.386-1-laurent@vivier.eu> References: <20180608200558.386-1-laurent@vivier.eu> Subject: [Qemu-devel] [RFC 10/13] dp8393x: fix dp8393x_receive List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Aurelien Jarno , qemu-block@nongnu.org, Gerd Hoffmann , "Dr. David Alan Gilbert" , =?UTF-8?q?Andreas=20F=C3=A4rber?= , Jason Wang , Paolo Bonzini , Yongbok Kim , Fam Zheng , Max Reitz , Kevin Wolf , =?UTF-8?q?Herv=C3=A9=20Poussineau?= , Laurent Vivier address_space_rw() access size must be multiplied by width. dp8393x_receive() must return the number of bytes read, not the length of the last memory access. Signed-off-by: Laurent Vivier --- hw/net/dp8393x.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c index f2d2ce344c..ef5f1eb94f 100644 --- a/hw/net/dp8393x.c +++ b/hw/net/dp8393x.c @@ -808,9 +808,11 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf, /* EOL detected */ s->regs[SONIC_ISR] |= SONIC_ISR_RDE; } else { + size = sizeof(uint16_t) * width; data[0 * width] = 0; /* in_use */ - address_space_rw(&s->as, dp8393x_crda(s) + sizeof(uint16_t) * 6 * width, - MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, sizeof(uint16_t), 1); + address_space_rw(&s->as, + dp8393x_crda(s) + sizeof(uint16_t) * 6 * width, + MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 1); s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA]; s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX; s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) | (((s->regs[SONIC_RSC] & 0x00ff) + 1) & 0x00ff); @@ -824,7 +826,7 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf, /* Done */ dp8393x_update_irq(s); - return size; + return rx_len; } static void dp8393x_reset(DeviceState *dev) -- 2.14.4