On Sun, 04 Oct 2026 19:23:51 +0900, Marc-André Lureau wrote: > > sh_serial_can_receive() used rx_head (the circular buffer write pointer) > to compute available space. Since rx_head wraps around, this could > overestimate or underestimate the remaining capacity. Use rx_cnt, which > tracks the actual number of buffered bytes. > > Reported-by: Pavee Hui <[email protected]> > Fixes: 543671d9907f ("hw/char/sh_serial: Return correct number of empty RX > FIFO elements") > Signed-off-by: Marc-André Lureau <[email protected]> > --- > hw/char/sh_serial.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c > index 30a22ea2d1c0..8728842b84e0 100644 > --- a/hw/char/sh_serial.c > +++ b/hw/char/sh_serial.c > @@ -316,7 +316,7 @@ static uint64_t sh_serial_read(void *opaque, hwaddr offs, > > static int sh_serial_can_receive(SHSerialState *s) > { > - return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_head : 0; > + return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_cnt : 0; > } > > static void sh_serial_receive_break(SHSerialState *s) > > -- > 2.56.0.rc0.29.g47ce80527c56 >
Reviewed-by: Yoshinori Sato <[email protected]> -- Yosinori Sato
