On 6 June 2016 at 13:00, Paolo Bonzini wrote:
>
>
> On 31/05/2016 13:36, P J P wrote:
>> +if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
>> +/* Data out. */
>> +qemu_log_mask(LOG_UNIMP, "esp: PIO data read not
>> implemented\n");
>> +s->rregs[ESP_FI
On 31/05/2016 13:36, P J P wrote:
> +if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
> +/* Data out. */
> +qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
> +s->rregs[ESP_FIFO] = 0;
> +esp_raise_irq(s);
> +} else
+-- On Tue, 31 May 2016, P J P wrote --+
| switch (saddr) {
| case ESP_FIFO:
| -if (s->ti_size > 0) {
| +if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
| +/* Data out. */
| +qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
| +
From: Prasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte
FIFO buffers. One is used to handle commands and other is for
information transfer. While reading/writing to these buffers
an index into 's->ti_buf[TI_BUFSZ=16]' could exceed its size.
Add check to avoid OOB r/w
