On 3/1/2026 7:26 PM, Jamin Lin wrote:
> mock_i3c_target_tx() did not update *num_sent before returning.
>
> Although some callers may not directly use this value, i3c_send()
> passes num_sent to trace_i3c_send(). If the target TX callback does
> not initialize *num_sent, the trace output may report an incorrect
> or uninitialized value, leading to confusing debugging information.
>
> For example, the following trace was observed:
>
> mock_i3c_target_tx I3C mock target write 0x12
> i3c_send I3C send 0/1 bytes, ack=1 (expected 1/1 bytes)
>
> This happens because *num_sent was never set by the TX callback.
>
> Fix this by setting:
>
> *num_sent = to_write;
>
> so that the actual number of transmitted bytes is correctly
> propagated back to i3c_send() and reflected in trace output.
>
> Signed-off-by: Jamin Lin <[email protected]>
> ---
> hw/i3c/mock-i3c-target.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/hw/i3c/mock-i3c-target.c b/hw/i3c/mock-i3c-target.c
> index 875cd7c7d0..5c913ee49b 100644
> --- a/hw/i3c/mock-i3c-target.c
> +++ b/hw/i3c/mock-i3c-target.c
> @@ -86,6 +86,7 @@ static int mock_i3c_target_tx(I3CTarget *i3c, const uint8_t
> *data,
> s->buf[s->p_buf] = data[i];
> s->p_buf++;
> }
> + *num_sent = to_write;
Thanks for fixing this... could you also set *num_sent to 1 in the ibi return
path earlier in the function (snippet below), where it seems to consume exactly
1 byte of data
...
<snip>
if (s->cfg.ibi_magic && num_to_send == 1 && s->cfg.ibi_magic == *data) {
mock_i3c_target_ibi_timer_start(s);
+ *num_sent = 1;
return 0;
}
</snip>
> return ret;
> }
>
Jithu
