[Qemu-devel] [RFC][PATCH] lsi53c895a: Update dnad when skipping MSGOUT bytes

[Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>]

Update not only dbc but also dnad when skipping bytes during the MSGOUT
phase.  Previously only dbc was updated which is probably wrong and
could lead to bogus message codes being read.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
I don't know the LSI SCSI code well but it seems odd that only dbc is updated
but the actual address isn't bumped when skipping bytes.  Unfortunately I
cannot test this because I don't know how to trigger SDTR/WDTR extended
messages.  Any ideas?

Came across this issue while looking into the following bug report:
https://bugs.launchpad.net/qemu/+bug/697510

 hw/lsi53c895a.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index 0129ae3..c73f60a 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -842,6 +842,13 @@ static uint8_t lsi_get_msgbyte(LSIState *s)
     return data;
 }
 
+/* Skip the next n bytes during a MSGOUT phase. */
+static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
+{
+    s->dnad += n;
+    s->dbc  -= n;
+}
+
 static void lsi_do_msgout(LSIState *s)
 {
     uint8_t msg;
@@ -869,11 +876,11 @@ static void lsi_do_msgout(LSIState *s)
             switch (msg) {
             case 1:
                 DPRINTF("SDTR (ignored)\n");
-                s->dbc -= 2;
+                lsi_skip_msgbytes(s, 2);
                 break;
             case 3:
                 DPRINTF("WDTR (ignored)\n");
-                s->dbc -= 1;
+                lsi_skip_msgbytes(s, 1);
                 break;
             default:
                 goto bad;
-- 
1.7.2.3