Index: qemu/hw/pcnet.c
===================================================================
--- qemu.orig/hw/pcnet.c	2008-04-17 18:06:24.000000000 +0000
+++ qemu/hw/pcnet.c	2008-04-17 18:10:38.000000000 +0000
@@ -1232,6 +1232,9 @@
 {
     target_phys_addr_t xmit_cxda = 0;
     int count = CSR_XMTRL(s)-1;
+    IOVector *ivec;
+    unsigned int nsg = 0;
+
     s->xmit_pos = -1;
 
     if (!CSR_TXON(s)) {
@@ -1251,18 +1254,21 @@
         printf("  TMDLOAD 0x%08x\n", PHYSADDR(s,CSR_CXDA(s)));
         PRINT_TMD(&tmd);
 #endif
+        if (CSR_BSWP(s))
+            ivec = iovector_new(2, s->phys_mem_read_bswap,
+                                s->phys_mem_write_bswap,
+                                s->dma_opaque);
+        else
+            ivec = iovector_new(2, s->phys_mem_read, s->phys_mem_write,
+                                s->dma_opaque);
         if (GET_FIELD(tmd.status, TMDS, STP)) {
             s->xmit_pos = 0;
             if (!GET_FIELD(tmd.status, TMDS, ENP)) {
                 int bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
 
-                if (CSR_BSWP(s))
-                    s->phys_mem_read_bswap(s->dma_opaque,
-                                           PHYSADDR(s, tmd.tbadr),
-                                           s->buffer, bcnt);
-                else
-                    s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
-                                     s->buffer, bcnt);
+                ivec->sg[nsg].base = PHYSADDR(s, tmd.tbadr);
+                ivec->sg[nsg].len = bcnt;
+                nsg++;
                 s->xmit_pos += bcnt;
             }
             xmit_cxda = PHYSADDR(s,CSR_CXDA(s));
@@ -1270,12 +1276,9 @@
         if (GET_FIELD(tmd.status, TMDS, ENP) && (s->xmit_pos >= 0)) {
             int bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
 
-            if (CSR_BSWP(s))
-                s->phys_mem_read_bswap(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
-                                       s->buffer + s->xmit_pos, bcnt);
-            else
-                s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
-                                 s->buffer + s->xmit_pos, bcnt);
+            ivec->sg[nsg].base = PHYSADDR(s, tmd.tbadr);
+            ivec->sg[nsg].len = bcnt;
+            nsg++;
             s->xmit_pos += bcnt;
 #ifdef PCNET_DEBUG
             printf("pcnet_transmit size=%d\n", s->xmit_pos);
@@ -1283,9 +1286,10 @@
             // XXX if (CSR_LOOP(s))
             //    pcnet_receive(s, s->buffer, s->xmit_pos);
             //else
-                if (s->vc)
-                    qemu_send_packet(s->vc, s->buffer, s->xmit_pos);
+            if (s->vc)
+                qemu_sendv_packet(s->vc, ivec);
 
+            iovector_free(ivec);
             s->csr[0] &= ~0x0008;   /* clear TDMD */
             s->csr[4] |= 0x0004;    /* set TXSTRT */
             s->xmit_pos = -1;