gwj / at91sam9263 · Commits

Commit 67cd24a89738ba03f5e8d9a4073c9a923d882bf6

Authored by ths
1 parent 7faa239c

Buffer length fixes, by Wang Cheng Yeh. 


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@2736 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 5 additions and 4 deletions
hw/scsi-disk.c
  View file @67cd24a
... ... @@ -345,7 +345,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
345 345 DPRINTF("Request Sense (len %d)\n", len);
346 346 if (len < 4)
347 347 goto fail;
348   - memset(buf, 0, 4);
  348 + memset(outbuf, 0, 4);
349 349 outbuf[0] = 0xf0;
350 350 outbuf[1] = 0;
351 351 outbuf[2] = s->sense;
... ... @@ -371,7 +371,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
371 371 Some later commands are also implemented. */
372 372 outbuf[2] = 3;
373 373 outbuf[3] = 2; /* Format 2 */
374   - outbuf[4] = 32;
  374 + outbuf[4] = 31;
375 375 /* Sync data transfer and TCQ. */
376 376 outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0);
377 377 r->buf_len = 36;
... ... @@ -404,10 +404,11 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
404 404 p += 4;
405 405 if ((page == 8 || page == 0x3f)) {
406 406 /* Caching page. */
  407 + memset(p,0,20);
407 408 p[0] = 8;
408 409 p[1] = 0x12;
409 410 p[2] = 4; /* WCE */
410   - p += 19;
  411 + p += 20;
411 412 }
412 413 if ((page == 0x3f || page == 0x2a)
413 414 && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) {
... ... @@ -437,7 +438,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
437 438 p[19] = (16 * 176) & 0xff;
438 439 p[20] = (16 * 176) >> 8; // 16x write speed current
439 440 p[21] = (16 * 176) & 0xff;
440   - p += 21;
  441 + p += 22;
441 442 }
442 443 r->buf_len = p - outbuf;
443 444 outbuf[0] = r->buf_len - 4;
... ...