@@ -87,7 +87,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
s->io_buffer_index &= 0x7ff;
}
- s->io_buffer_size = io->len;
+ s->io_buffer_size = MIN(io->len, s->packet_transfer_size);
MACIO_DPRINTF("remainder: %d io->len: %d size: %d\n", io->remainder_len,
io->len, s->packet_transfer_size);
@@ -251,7 +251,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
/* launch next transfer */
s->io_buffer_index = 0;
- s->io_buffer_size = io->len;
+ s->io_buffer_size = MIN(io->len, s->nsector * 512);
/* handle unaligned accesses first, get them over with and only do the
remaining bulk transfer using our async DMA helpers */
A DMA request can happen for data that hasn't been completely been provided by the IDE core yet. For example - DBDMA request for 0x1000 bytes - IDE request for 1 sector - DBDMA wants to read 0x1000 bytes (8 sectors) from bdrv - breakage Instead, we should truncate our bdrv request to the maximum number of sectors we're allowed to read at that given time. Once that transfer is through, we will fall into our recently introduced waiting logic. - DBDMA requests for 0x1000 bytes - IDE request for 1 sector - DBDMA wants to read MIN(0x1000, 1 * 512) bytes - DBDMA finishes reading, indicates to IDE core that transfer is complete - IDE request for 7 sectors - DBDMA finishes the DMA Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Alexander Graf <agraf@suse.de> --- hw/ide/macio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)