Commit 67cd24a89738ba03f5e8d9a4073c9a923d882bf6
1 parent
7faa239c
Buffer length fixes, by Wang Cheng Yeh.
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@2736 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
1 changed file
with
5 additions
and
4 deletions
hw/scsi-disk.c
@@ -345,7 +345,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | @@ -345,7 +345,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | ||
345 | DPRINTF("Request Sense (len %d)\n", len); | 345 | DPRINTF("Request Sense (len %d)\n", len); |
346 | if (len < 4) | 346 | if (len < 4) |
347 | goto fail; | 347 | goto fail; |
348 | - memset(buf, 0, 4); | 348 | + memset(outbuf, 0, 4); |
349 | outbuf[0] = 0xf0; | 349 | outbuf[0] = 0xf0; |
350 | outbuf[1] = 0; | 350 | outbuf[1] = 0; |
351 | outbuf[2] = s->sense; | 351 | outbuf[2] = s->sense; |
@@ -371,7 +371,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | @@ -371,7 +371,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | ||
371 | Some later commands are also implemented. */ | 371 | Some later commands are also implemented. */ |
372 | outbuf[2] = 3; | 372 | outbuf[2] = 3; |
373 | outbuf[3] = 2; /* Format 2 */ | 373 | outbuf[3] = 2; /* Format 2 */ |
374 | - outbuf[4] = 32; | 374 | + outbuf[4] = 31; |
375 | /* Sync data transfer and TCQ. */ | 375 | /* Sync data transfer and TCQ. */ |
376 | outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0); | 376 | outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0); |
377 | r->buf_len = 36; | 377 | r->buf_len = 36; |
@@ -404,10 +404,11 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | @@ -404,10 +404,11 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | ||
404 | p += 4; | 404 | p += 4; |
405 | if ((page == 8 || page == 0x3f)) { | 405 | if ((page == 8 || page == 0x3f)) { |
406 | /* Caching page. */ | 406 | /* Caching page. */ |
407 | + memset(p,0,20); | ||
407 | p[0] = 8; | 408 | p[0] = 8; |
408 | p[1] = 0x12; | 409 | p[1] = 0x12; |
409 | p[2] = 4; /* WCE */ | 410 | p[2] = 4; /* WCE */ |
410 | - p += 19; | 411 | + p += 20; |
411 | } | 412 | } |
412 | if ((page == 0x3f || page == 0x2a) | 413 | if ((page == 0x3f || page == 0x2a) |
413 | && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) { | 414 | && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) { |
@@ -437,7 +438,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | @@ -437,7 +438,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun) | ||
437 | p[19] = (16 * 176) & 0xff; | 438 | p[19] = (16 * 176) & 0xff; |
438 | p[20] = (16 * 176) >> 8; // 16x write speed current | 439 | p[20] = (16 * 176) >> 8; // 16x write speed current |
439 | p[21] = (16 * 176) & 0xff; | 440 | p[21] = (16 * 176) & 0xff; |
440 | - p += 21; | 441 | + p += 22; |
441 | } | 442 | } |
442 | r->buf_len = p - outbuf; | 443 | r->buf_len = p - outbuf; |
443 | outbuf[0] = r->buf_len - 4; | 444 | outbuf[0] = r->buf_len - 4; |