sh_serial_can_receive() used rx_head (the circular buffer write pointer) to compute available space. Since rx_head wraps around, this could overestimate or underestimate the remaining capacity. Use rx_cnt, which tracks the actual number of buffered bytes.
Reported-by: Pavee Hui <[email protected]> Fixes: 543671d9907f ("hw/char/sh_serial: Return correct number of empty RX FIFO elements") Signed-off-by: Marc-André Lureau <[email protected]> --- hw/char/sh_serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c index 30a22ea2d1c0..8728842b84e0 100644 --- a/hw/char/sh_serial.c +++ b/hw/char/sh_serial.c @@ -316,7 +316,7 @@ static uint64_t sh_serial_read(void *opaque, hwaddr offs, static int sh_serial_can_receive(SHSerialState *s) { - return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_head : 0; + return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_cnt : 0; } static void sh_serial_receive_break(SHSerialState *s) -- 2.56.0.rc0.29.g47ce80527c56
