aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStefan Hajnoczi <stefanha@linux.vnet.ibm.com>2012-01-07 11:59:59 +0000
committerStefan Hajnoczi <stefanha@linux.vnet.ibm.com>2012-01-13 10:36:59 +0000
commit3c8359d11aee9d3fdcab0f184605f603f91f34f7 (patch)
treee6971561cd7f78bf491324819e6111b39791da43
parentcee8e6add587e20ed1f4c5a95031a1697d7375b1 (diff)
downloadqemu-3c8359d11aee9d3fdcab0f184605f603f91f34f7.zip
qemu-3c8359d11aee9d3fdcab0f184605f603f91f34f7.tar.gz
qemu-3c8359d11aee9d3fdcab0f184605f603f91f34f7.tar.bz2
omap_dss: correct chip[1] index in RFBI_READ/RFBI_STATUS
The RFBI_READ/RFBI_STATUS code incorrectly uses chip[0] when it should be using chip[1]. Andrzej Zaborowski <balrog@zabor.org> confirmed this bug since I don't know this code well. Reported-by: Dr David Alan Gilbert <davidagilbert@uk.ibm.com> Reviewed-by: Andrzej Zaborowski <andrew.zaborowski@intel.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
-rw-r--r--hw/omap_dss.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/omap_dss.c b/hw/omap_dss.c
index ede640b..86ed6ea 100644
--- a/hw/omap_dss.c
+++ b/hw/omap_dss.c
@@ -793,7 +793,7 @@ static void omap_rfbi_write(void *opaque, target_phys_addr_t addr,
if ((s->rfbi.control & (1 << 2)) && s->rfbi.chip[0])
s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 1);
else if ((s->rfbi.control & (1 << 3)) && s->rfbi.chip[1])
- s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 1);
+ s->rfbi.rxbuf = s->rfbi.chip[1]->read(s->rfbi.chip[1]->opaque, 1);
if (!-- s->rfbi.pixels)
omap_rfbi_transfer_stop(s);
break;
@@ -802,7 +802,7 @@ static void omap_rfbi_write(void *opaque, target_phys_addr_t addr,
if ((s->rfbi.control & (1 << 2)) && s->rfbi.chip[0])
s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 0);
else if ((s->rfbi.control & (1 << 3)) && s->rfbi.chip[1])
- s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 0);
+ s->rfbi.rxbuf = s->rfbi.chip[1]->read(s->rfbi.chip[1]->opaque, 0);
if (!-- s->rfbi.pixels)
omap_rfbi_transfer_stop(s);
break;