Use 'frame_size' instead of 'len' when calling qemu_send_packet(), failing to do so results in malformed packets send in case when that packed is fragmented into multiple DMA transactions.
Cc: Peter Maydell <peter.mayd...@linaro.org> Cc: Jason Wang <jasow...@redhat.com> Cc: Philippe Mathieu-Daudé <f4...@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-...@nongnu.org Cc: yurov...@gmail.com Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smir...@gmail.com> --- hw/net/imx_fec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c index 38d8c27dcd..eefb3b2c62 100644 --- a/hw/net/imx_fec.c +++ b/hw/net/imx_fec.c @@ -528,7 +528,7 @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index) } } /* Last buffer in frame. */ - qemu_send_packet(qemu_get_queue(s->nic), frame, len); + qemu_send_packet(qemu_get_queue(s->nic), frame, frame_size); ptr = frame; frame_size = 0; if (bd.option & ENET_BD_TX_INT) { -- 2.13.5