--- /dev/null
+From: Peter Crosthwaite <crosthwaitepeter@gmail.com>
+Subject: [RFT PATCH v1 1/3] net: smc91c111: guard flush_queued_packets() on
+ can_rx()
+Date: Thu, 10 Sep 2015 21:23:43 -0700
+
+Check that the core can once again receive packets before asking the
+net layer to do a flush. This will make it more convenient to flush
+packets when adding new conditions to can_receive.
+
+Add missing if braces while moving the can_receive() core code.
+
+Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+
+Upstream-Status: Submitted
+
+---
+
+ hw/net/smc91c111.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+Index: qemu-2.4.0/hw/net/smc91c111.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/smc91c111.c
++++ qemu-2.4.0/hw/net/smc91c111.c
+@@ -124,6 +124,24 @@ static void smc91c111_update(smc91c111_s
+ qemu_set_irq(s->irq, level);
+ }
+
++static int smc91c111_can_receive(smc91c111_state *s)
++{
++ if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
++ return 1;
++ }
++ if (s->allocated == (1 << NUM_PACKETS) - 1) {
++ return 0;
++ }
++ return 1;
++}
++
++static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
++{
++ if (smc91c111_can_receive(s)) {
++ qemu_flush_queued_packets(qemu_get_queue(s->nic));
++ }
++}
++
+ /* Try to allocate a packet. Returns 0x80 on failure. */
+ static int smc91c111_allocate_packet(smc91c111_state *s)
+ {
+@@ -185,7 +203,7 @@ static void smc91c111_release_packet(smc
+ s->allocated &= ~(1 << packet);
+ if (s->tx_alloc == 0x80)
+ smc91c111_tx_alloc(s);
+- qemu_flush_queued_packets(qemu_get_queue(s->nic));
++ smc91c111_flush_queued_packets(s);
+ }
+
+ /* Flush the TX FIFO. */
+@@ -636,15 +654,11 @@ static uint32_t smc91c111_readl(void *op
+ return val;
+ }
+
+-static int smc91c111_can_receive(NetClientState *nc)
++static int smc91c111_can_receive_nc(NetClientState *nc)
+ {
+ smc91c111_state *s = qemu_get_nic_opaque(nc);
+
+- if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
+- return 1;
+- if (s->allocated == (1 << NUM_PACKETS) - 1)
+- return 0;
+- return 1;
++ return smc91c111_can_receive(s);
+ }
+
+ static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+@@ -739,7 +753,7 @@ static const MemoryRegionOps smc91c111_m
+ static NetClientInfo net_smc91c111_info = {
+ .type = NET_CLIENT_OPTIONS_KIND_NIC,
+ .size = sizeof(NICState),
+- .can_receive = smc91c111_can_receive,
++ .can_receive = smc91c111_can_receive_nc,
+ .receive = smc91c111_receive,
+ };
+
--- /dev/null
+From: Peter Crosthwaite <crosthwaitepeter@gmail.com>
+X-Google-Original-From: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+To: qemu-devel@nongnu.org
+Cc: peter.maydell@linaro.org, richard.purdie@linuxfoundation.org
+Subject: [RFT PATCH v1 2/3] net: smc91c111: gate can_receive() on rx FIFO
+ having a slot
+Date: Thu, 10 Sep 2015 21:23:57 -0700
+
+Return false from can_receive() when the FIFO doesn't have a free RX
+slot. This fixes a bug in the current code where the allocated buffer
+is freed before the fifo pop, triggering a premature flush of queued RX
+packets. It also will handle a corner case, where the guest manually
+frees the allocated buffer before popping the rx FIFO (hence it is not
+enough to just delay the flush_queued_packets()).
+
+Reported-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+
+Upstream-Status: Submitted
+---
+
+ hw/net/smc91c111.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+Index: qemu-2.4.0/hw/net/smc91c111.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/smc91c111.c
++++ qemu-2.4.0/hw/net/smc91c111.c
+@@ -129,7 +129,8 @@ static int smc91c111_can_receive(smc91c1
+ if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
+ return 1;
+ }
+- if (s->allocated == (1 << NUM_PACKETS) - 1) {
++ if (s->allocated == (1 << NUM_PACKETS) - 1 ||
++ s->rx_fifo_len == NUM_PACKETS) {
+ return 0;
+ }
+ return 1;
+@@ -182,6 +183,7 @@ static void smc91c111_pop_rx_fifo(smc91c
+ } else {
+ s->int_level &= ~INT_RCV;
+ }
++ smc91c111_flush_queued_packets(s);
+ smc91c111_update(s);
+ }
+
--- /dev/null
+From: Peter Crosthwaite <crosthwaitepeter@gmail.com>
+To: qemu-devel@nongnu.org
+Cc: peter.maydell@linaro.org, richard.purdie@linuxfoundation.org
+Subject: [RFT PATCH v1 3/3] net: smc91c111: flush packets on RCR register
+ changes
+Date: Thu, 10 Sep 2015 21:24:12 -0700
+
+The SOFT_RST or RXEN in the control register can be used as a condition
+to unblock the net layer via can_receive(). So check for possible
+flushes on RCR changes. This will drop all pending packets on soft
+reset or disable which is the functional intent of the can_receive()
+logic.
+
+Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+
+Upstream-Status: Submitted
+---
+
+ hw/net/smc91c111.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+Index: qemu-2.4.0/hw/net/smc91c111.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/smc91c111.c
++++ qemu-2.4.0/hw/net/smc91c111.c
+@@ -331,6 +331,7 @@ static void smc91c111_writeb(void *opaqu
+ if (s->rcr & RCR_SOFT_RST) {
+ smc91c111_reset(DEVICE(s));
+ }
++ smc91c111_flush_queued_packets(s);
+ return;
+ case 10: case 11: /* RPCR */
+ /* Ignored */
SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://qemu-enlarge-env-entry-size.patch \
file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \
- file://smc91c111_fix.patch \
+ file://smc91c111_fix1.patch \
+ file://smc91c111_fix2.patch \
+ file://smc91c111_fix3.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
