4 files changed, 167 insertions, 1 deletions

diff --git a/meta/recipes-devtools/qemu/qemu/smc91c111_fix1.patch b/meta/recipes-devtools/qemu/qemu/smc91c111_fix1.patch
new file mode 100644
index 0000000000..bd1223a446
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/smc91c111_fix1.patch
@@ -0,0 +1,85 @@
+From: Peter Crosthwaite <crosthwaitepeter@gmail.com>
+Subject: [RFT PATCH v1 1/3] net: smc91c111: guard flush_queued_packets() on
+ can_rx()
+Date: Thu, 10 Sep 2015 21:23:43 -0700
+
+Check that the core can once again receive packets before asking the
+net layer to do a flush. This will make it more convenient to flush
+packets when adding new conditions to can_receive.
+
+Add missing if braces while moving the can_receive() core code.
+
+Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+
+Upstream-Status: Submitted
+
+---
+
+ hw/net/smc91c111.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+Index: qemu-2.4.0/hw/net/smc91c111.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/smc91c111.c
++++ qemu-2.4.0/hw/net/smc91c111.c
+@@ -124,6 +124,24 @@ static void smc91c111_update(smc91c111_s
+     qemu_set_irq(s->irq, level);
+ }
+ 
++static int smc91c111_can_receive(smc91c111_state *s)
++{
++    if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
++        return 1;
++    }
++    if (s->allocated == (1 << NUM_PACKETS) - 1) {
++        return 0;
++    }
++    return 1;
++}
++
++static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
++{
++    if (smc91c111_can_receive(s)) {
++        qemu_flush_queued_packets(qemu_get_queue(s->nic));
++    }
++}
++
+ /* Try to allocate a packet.  Returns 0x80 on failure.  */
+ static int smc91c111_allocate_packet(smc91c111_state *s)
+ {
+@@ -185,7 +203,7 @@ static void smc91c111_release_packet(smc
+     s->allocated &= ~(1 << packet);
+     if (s->tx_alloc == 0x80)
+         smc91c111_tx_alloc(s);
+-    qemu_flush_queued_packets(qemu_get_queue(s->nic));
++    smc91c111_flush_queued_packets(s);
+ }
+ 
+ /* Flush the TX FIFO.  */
+@@ -636,15 +654,11 @@ static uint32_t smc91c111_readl(void *op
+     return val;
+ }
+ 
+-static int smc91c111_can_receive(NetClientState *nc)
++static int smc91c111_can_receive_nc(NetClientState *nc)
+ {
+     smc91c111_state *s = qemu_get_nic_opaque(nc);
+ 
+-    if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
+-        return 1;
+-    if (s->allocated == (1 << NUM_PACKETS) - 1)
+-        return 0;
+-    return 1;
++    return smc91c111_can_receive(s);
+ }
+ 
+ static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+@@ -739,7 +753,7 @@ static const MemoryRegionOps smc91c111_m
+ static NetClientInfo net_smc91c111_info = {
+     .type = NET_CLIENT_OPTIONS_KIND_NIC,
+     .size = sizeof(NICState),
+-    .can_receive = smc91c111_can_receive,
++    .can_receive = smc91c111_can_receive_nc,
+     .receive = smc91c111_receive,
+ };
+ 
diff --git a/meta/recipes-devtools/qemu/qemu/smc91c111_fix2.patch b/meta/recipes-devtools/qemu/qemu/smc91c111_fix2.patch
new file mode 100644
index 0000000000..018aed5f80
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/smc91c111_fix2.patch
@@ -0,0 +1,46 @@
+From: Peter Crosthwaite <crosthwaitepeter@gmail.com>
+X-Google-Original-From: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+To: qemu-devel@nongnu.org
+Cc: peter.maydell@linaro.org, richard.purdie@linuxfoundation.org
+Subject: [RFT PATCH v1 2/3] net: smc91c111: gate can_receive() on rx FIFO
+ having a slot
+Date: Thu, 10 Sep 2015 21:23:57 -0700
+
+Return false from can_receive() when the FIFO doesn't have a free RX
+slot. This fixes a bug in the current code where the allocated buffer
+is freed before the fifo pop, triggering a premature flush of queued RX
+packets. It also will handle a corner case, where the guest manually
+frees the allocated buffer before popping the rx FIFO (hence it is not
+enough to just delay the flush_queued_packets()).
+
+Reported-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+
+Upstream-Status: Submitted
+---
+
+ hw/net/smc91c111.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+Index: qemu-2.4.0/hw/net/smc91c111.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/smc91c111.c
++++ qemu-2.4.0/hw/net/smc91c111.c
+@@ -129,7 +129,8 @@ static int smc91c111_can_receive(smc91c1
+     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
+         return 1;
+     }
+-    if (s->allocated == (1 << NUM_PACKETS) - 1) {
++    if (s->allocated == (1 << NUM_PACKETS) - 1 ||
++        s->rx_fifo_len == NUM_PACKETS) {
+         return 0;
+     }
+     return 1;
+@@ -182,6 +183,7 @@ static void smc91c111_pop_rx_fifo(smc91c
+     } else {
+         s->int_level &= ~INT_RCV;
+     }
++    smc91c111_flush_queued_packets(s);
+     smc91c111_update(s);
+ }
+ 
diff --git a/meta/recipes-devtools/qemu/qemu/smc91c111_fix3.patch b/meta/recipes-devtools/qemu/qemu/smc91c111_fix3.patch
new file mode 100644
index 0000000000..9e865f7f09
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/smc91c111_fix3.patch
@@ -0,0 +1,33 @@
+From: Peter Crosthwaite <crosthwaitepeter@gmail.com>
+To: qemu-devel@nongnu.org
+Cc: peter.maydell@linaro.org, richard.purdie@linuxfoundation.org
+Subject: [RFT PATCH v1 3/3] net: smc91c111: flush packets on RCR register
+ changes
+Date: Thu, 10 Sep 2015 21:24:12 -0700
+
+The SOFT_RST or RXEN in the control register can be used as a condition
+to unblock the net layer via can_receive(). So check for possible
+flushes on RCR changes. This will drop all pending packets on soft
+reset or disable which is the functional intent of the can_receive()
+logic.
+
+Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+
+Upstream-Status: Submitted
+---
+
+ hw/net/smc91c111.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+Index: qemu-2.4.0/hw/net/smc91c111.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/smc91c111.c
++++ qemu-2.4.0/hw/net/smc91c111.c
+@@ -331,6 +331,7 @@ static void smc91c111_writeb(void *opaqu
+             if (s->rcr & RCR_SOFT_RST) {
+                 smc91c111_reset(DEVICE(s));
+             }
++            smc91c111_flush_queued_packets(s);
+             return;
+         case 10: case 11: /* RPCR */
+             /* Ignored */
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index d545b60f64..59b1788007 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -6,7 +6,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \
 SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
             file://qemu-enlarge-env-entry-size.patch \
             file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \
-            file://smc91c111_fix.patch \
+            file://smc91c111_fix1.patch \
+            file://smc91c111_fix2.patch \
+            file://smc91c111_fix3.patch \
            "
 SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
 SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"