The last entry in the RRA is at the address given by the REA register.
The address wrap-around logic is off-by-one entry. The last resource
never gets used and RRP can jump over the RWP. The guest driver fails
badly because the SONIC starts re-using old buffer addresses. Fix this.
Signed-off-by: Finn Thain <fth...@telegraphics.com.au>
---
hw/net/dp8393x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index bd92fa28f6..92a30f9f69 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -340,7 +340,7 @@ static void dp8393x_do_read_rra(dp8393xState *s)
s->regs[SONIC_RRP] += size;
/* Handle wrap */
- if (s->regs[SONIC_RRP] == s->regs[SONIC_REA]) {
+ if (s->regs[SONIC_RRP] == s->regs[SONIC_REA] + size) {
s->regs[SONIC_RRP] = s->regs[SONIC_RSA];
}
--
2.23.0
