Re: [PATCH qemu] [hw/char/bcm2835_aux] Fix receive FIFO filling up (raspi3)

[Peter Maydell <peter.maydell@linaro.org>]

On Mon, 22 Jul 2024 at 10:44, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> [Added missing cc of qemu-devel]
>
> On Mon, 22 Jul 2024 at 07:33, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
> >
> > On 21/7/24 18:13, ~fvanhovell wrote:
> > > From: Frederik van Hövell <frederik@fvhovell.nl>
> > >
> > > When a bare-metal application on the raspi3 board reads the
> > > AUX_MU_STAT_REG MMIO register while the device's buffer is
> > > at full receive FIFO capacity
> > > (i.e. `s->read_count == BCM2835_AUX_RX_FIFO_LEN`) the
> > > assertion `assert(s->read_count < BCM2835_AUX_RX_FIFO_LEN)`
> > > fails.
> > >
> >
> > Reported-by: Cryptjar <cryptjar@junk.studio>
> > Suggested-by: Cryptjar <cryptjar@junk.studio>
> > Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> >
> > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/459
> > > Signed-off-by: Frederik van Hövell <frederik@fvhovell.nl>
> > > ---
> > >   hw/char/bcm2835_aux.c | 2 +-
> > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
> > > index 83990e20f7..fca2f27a55 100644
> > > --- a/hw/char/bcm2835_aux.c
> > > +++ b/hw/char/bcm2835_aux.c
> > > @@ -138,7 +138,7 @@ static uint64_t bcm2835_aux_read(void *opaque, hwaddr offset, unsigned size)
> > >           res = 0x30e; /* space in the output buffer, empty tx fifo, idle tx/rx */
> > >           if (s->read_count > 0) {
> > >               res |= 0x1; /* data in input buffer */
> > > -            assert(s->read_count < BCM2835_AUX_RX_FIFO_LEN);
> > > +            assert(s->read_count <= BCM2835_AUX_RX_FIFO_LEN);
> > >               res |= ((uint32_t)s->read_count) << 16; /* rx fifo fill level */
> > >           }
> > >           return res;
> >




Applied to target-arm.next, thanks.

-- PMM