qxl/update_area_io: guest_bug on invalid parameters

[qemu.git] / hw / bt-hci-csr.c

diff --git a/hw/bt-hci-csr.c b/hw/bt-hci-csr.c
index 892801e00ae0c44ed3ce67e3017890106f5cb715..772b677ba177f60f0f1e40c4cb41f9a14ae0638c 100644 (file)
--- a/hw/bt-hci-csr.c
+++ b/hw/bt-hci-csr.c
@@ -22,7 +22,6 @@
 #include "qemu-char.h"
 #include "qemu-timer.h"
 #include "irq.h"
-#include "sysemu.h"
 #include "net.h"
 #include "bt.h"
 
@@ -44,7 +43,7 @@ struct csrhci_s {
     QEMUTimer *out_tm;
     int64_t baud_delay;
 
-    a_bdaddr bd_addr;
+    bdaddr_t bd_addr;
     struct HCIInfo *hci;
 };
 
@@ -88,7 +87,7 @@ static inline void csrhci_fifo_wake(struct csrhci_s *s)
     }
 
     if (s->out_len)
-        qemu_mod_timer(s->out_tm, qemu_get_clock(vm_clock) + s->baud_delay);
+        qemu_mod_timer(s->out_tm, qemu_get_clock_ns(vm_clock) + s->baud_delay);
 }
 
 #define csrhci_out_packetz(s, len) memset(csrhci_out_packet(s, len), 0, len)
@@ -223,10 +222,10 @@ static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt)
 
         rpkt = csrhci_out_packet_csr(s, H4_NEG_PKT, 10);
 
-        *rpkt ++ = 0x20;       /* Operational settings negotation Ok */
+        *rpkt ++ = 0x20;       /* Operational settings negotiation Ok */
         memcpy(rpkt, pkt, 7); rpkt += 7;
         *rpkt ++ = 0xff;
-        *rpkt ++ = 0xff;
+        *rpkt = 0xff;
         break;
 
     case H4_ALIVE_PKT:
@@ -238,7 +237,7 @@ static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt)
         rpkt = csrhci_out_packet_csr(s, H4_ALIVE_PKT, 2);
 
         *rpkt ++ = 0xcc;
-        *rpkt ++ = 0x00;
+        *rpkt = 0x00;
         break;
 
     default:
@@ -398,7 +397,7 @@ static void csrhci_reset(struct csrhci_s *s)
     /* After a while... (but sooner than 10ms) */
     s->modem_state |= CHR_TIOCM_CTS;
 
-    memset(&s->bd_addr, 0, sizeof(a_bdaddr));
+    memset(&s->bd_addr, 0, sizeof(bdaddr_t));
 }
 
 static void csrhci_out_tick(void *opaque)
@@ -435,7 +434,7 @@ qemu_irq *csrhci_pins_get(CharDriverState *chr)
 CharDriverState *uart_hci_init(qemu_irq wakeup)
 {
     struct csrhci_s *s = (struct csrhci_s *)
-            qemu_mallocz(sizeof(struct csrhci_s));
+            g_malloc0(sizeof(struct csrhci_s));
 
     s->chr.opaque = s;
     s->chr.chr_write = csrhci_write;
@@ -446,7 +445,7 @@ CharDriverState *uart_hci_init(qemu_irq wakeup)
     s->hci->evt_recv = csrhci_out_hci_packet_event;
     s->hci->acl_recv = csrhci_out_hci_packet_acl;
 
-    s->out_tm = qemu_new_timer(vm_clock, csrhci_out_tick, s);
+    s->out_tm = qemu_new_timer_ns(vm_clock, csrhci_out_tick, s);
     s->pins = qemu_allocate_irqs(csrhci_pins, s, __csrhci_pins);
     csrhci_reset(s);