[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 53/53] ide: Clear DRQ after handling all expected a
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 53/53] ide: Clear DRQ after handling all expected accesses |
Date: |
Thu, 30 Jul 2015 06:33:08 -0500 |
From: Kevin Wolf <address@hidden>
This is additional hardening against an end_transfer_func that fails to
clear the DRQ status bit. The bit must be unset as soon as the PIO
transfer has completed, so it's better to do this in a central place
instead of duplicating the code in all commands (and forgetting it in
some).
Signed-off-by: Kevin Wolf <address@hidden>
Reviewed-by: John Snow <address@hidden>
(cherry picked from commit cb72cba83021fa42719e73a5249c12096a4d1cfc)
Signed-off-by: Michael Roth <address@hidden>
---
hw/ide/core.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 17153f5..822519b 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -2028,8 +2028,10 @@ void ide_data_writew(void *opaque, uint32_t addr,
uint32_t val)
*(uint16_t *)p = le16_to_cpu(val);
p += 2;
s->data_ptr = p;
- if (p >= s->data_end)
+ if (p >= s->data_end) {
+ s->status &= ~DRQ_STAT;
s->end_transfer_func(s);
+ }
}
uint32_t ide_data_readw(void *opaque, uint32_t addr)
@@ -2053,8 +2055,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr)
ret = cpu_to_le16(*(uint16_t *)p);
p += 2;
s->data_ptr = p;
- if (p >= s->data_end)
+ if (p >= s->data_end) {
+ s->status &= ~DRQ_STAT;
s->end_transfer_func(s);
+ }
return ret;
}
@@ -2078,8 +2082,10 @@ void ide_data_writel(void *opaque, uint32_t addr,
uint32_t val)
*(uint32_t *)p = le32_to_cpu(val);
p += 4;
s->data_ptr = p;
- if (p >= s->data_end)
+ if (p >= s->data_end) {
+ s->status &= ~DRQ_STAT;
s->end_transfer_func(s);
+ }
}
uint32_t ide_data_readl(void *opaque, uint32_t addr)
@@ -2103,8 +2109,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr)
ret = cpu_to_le32(*(uint32_t *)p);
p += 4;
s->data_ptr = p;
- if (p >= s->data_end)
+ if (p >= s->data_end) {
+ s->status &= ~DRQ_STAT;
s->end_transfer_func(s);
+ }
return ret;
}
--
1.9.1
- [Qemu-stable] [PATCH 40/53] target-ppc: fix hugepage support when using memory-backend-file, (continued)
- [Qemu-stable] [PATCH 40/53] target-ppc: fix hugepage support when using memory-backend-file, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 44/53] mips/kvm: Sign extend registers written to KVM, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 48/53] scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158), Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 47/53] vfio/pci: Fix bootindex, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 50/53] block: qemu-iotests - add check for multiplication overflow in vpc, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 49/53] block: vpc - prevent overflow if max_table_entries >= 0x40000000, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 04/53] nbd/trivial: fix type cast for ioctl, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 41/53] Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 51/53] ide: Check array bounds before writing to io_buffer (CVE-2015-5154), Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 52/53] ide/atapi: Fix START STOP UNIT command completion, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 53/53] ide: Clear DRQ after handling all expected accesses,
Michael Roth <=
- [Qemu-stable] [PATCH 06/53] vmdk: Fix overflow if l1_size is 0x20000000, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 05/53] vmdk: Fix next_cluster_sector for compressed write, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 07/53] qcow2: Flush pending discards before allocating cluster, Michael Roth, 2015/07/30
- [Qemu-stable] [PATCH 08/53] usb: fix usb-net segfault, Michael Roth, 2015/07/30