gwj / at91sam9263 · Commits

Commit 67cd24a89738ba03f5e8d9a4073c9a923d882bf6

Authored by ths
1 parent 7faa239c

Buffer length fixes, by Wang Cheng Yeh. 


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@2736 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 5 additions and 4 deletions
hw/scsi-disk.c
  View file @67cd24a
@@ -345,7 +345,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) @@ -345,7 +345,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
345 DPRINTF("Request Sense (len %d)\n", len); 345 DPRINTF("Request Sense (len %d)\n", len);
346 if (len < 4) 346 if (len < 4)
347 goto fail; 347 goto fail;
348 - memset(buf, 0, 4); 348 + memset(outbuf, 0, 4);
349 outbuf[0] = 0xf0; 349 outbuf[0] = 0xf0;
350 outbuf[1] = 0; 350 outbuf[1] = 0;
351 outbuf[2] = s->sense; 351 outbuf[2] = s->sense;
@@ -371,7 +371,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) @@ -371,7 +371,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
371 Some later commands are also implemented. */ 371 Some later commands are also implemented. */
372 outbuf[2] = 3; 372 outbuf[2] = 3;
373 outbuf[3] = 2; /* Format 2 */ 373 outbuf[3] = 2; /* Format 2 */
374 - outbuf[4] = 32; 374 + outbuf[4] = 31;
375 /* Sync data transfer and TCQ. */ 375 /* Sync data transfer and TCQ. */
376 outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0); 376 outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0);
377 r->buf_len = 36; 377 r->buf_len = 36;
@@ -404,10 +404,11 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) @@ -404,10 +404,11 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
404 p += 4; 404 p += 4;
405 if ((page == 8 || page == 0x3f)) { 405 if ((page == 8 || page == 0x3f)) {
406 /* Caching page. */ 406 /* Caching page. */
  407 + memset(p,0,20);
407 p[0] = 8; 408 p[0] = 8;
408 p[1] = 0x12; 409 p[1] = 0x12;
409 p[2] = 4; /* WCE */ 410 p[2] = 4; /* WCE */
410 - p += 19; 411 + p += 20;
411 } 412 }
412 if ((page == 0x3f || page == 0x2a) 413 if ((page == 0x3f || page == 0x2a)
413 && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) { 414 && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) {
@@ -437,7 +438,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) @@ -437,7 +438,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
437 p[19] = (16 * 176) & 0xff; 438 p[19] = (16 * 176) & 0xff;
438 p[20] = (16 * 176) >> 8; // 16x write speed current 439 p[20] = (16 * 176) >> 8; // 16x write speed current
439 p[21] = (16 * 176) & 0xff; 440 p[21] = (16 * 176) & 0xff;
440 - p += 21; 441 + p += 22;
441 } 442 }
442 r->buf_len = p - outbuf; 443 r->buf_len = p - outbuf;
443 outbuf[0] = r->buf_len - 4; 444 outbuf[0] = r->buf_len - 4;