workaround for cmd646 bmdma register access while no dma is active
authorIgor V. Kovalenko <igor.v.kovalenko@gmail.com>
Sun, 13 Dec 2009 19:03:31 +0000 (19:03 +0000)
committerBlue Swirl <blauwirbel@gmail.com>
Sun, 13 Dec 2009 19:03:31 +0000 (19:03 +0000)
commit59b66c8c3b33c7f908f814f765458935ed8b25c1
treec4b15718360671879c9e39bf9ebc92d728023c21
parented62c7d3fd9d5a67f7f08ff0dc5f145529b62a30
workaround for cmd646 bmdma register access while no dma is active

This is a workaround only, and is a partial revert
of a few changes to BMDMAState which removed pci_dev
field on the way.

- cmd646 pci_from_bm() expects bm->unit value to
correspond with bm data being passed to callback
as opaque pointer. This breaks when write to dma
control register of second channel happens when no
dma operation is in progress, so bm->unit is zero
for second channel, and pci_from_bm() returns garbage
pointer. Crash happens shortly after that while
dereferencing that pointer.

v0->v1: cleaned up dead code from pci_from_bm.

Signed-off-by: Igor V. Kovalenko <igor.v.kovalenko@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
hw/ide/cmd646.c
hw/ide/internal.h
hw/ide/piix.c