Commit 07641edc1c for qemu.org

commit 07641edc1c74afba5dce84bfc36211c10b0be023
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Mon Oct 26 15:24:09 2026 +0000

    hw/display/xlnx_dp: Make assertions clearer

    The xlnx_dp code has some assertions in its read and write functions
    guarding the fallback "read from core_registers[]" codepath.  The
    array can't be overrun because of the defined size of the memory
    region, but the read assert is confusingly written and the write
    assert seems to be completely garbled.

    Replace both with a simple check against the size the array, which
    makes it clear that we're asserting that we won't overflow it.

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4586
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-ID: <20261026152409.2869104-1-peter.maydell@linaro.org>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 98126ef320..d6b4e7bba6 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -795,10 +795,10 @@ static uint64_t xlnx_dp_read(void *opaque, hwaddr offset, unsigned size)
         ret = 0;
         break;
     default:
-        assert(offset <= (0x3AC >> 2));
         if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) {
             ret = s->core_registers[DP_INT_MASK];
         } else {
+            assert(offset < ARRAY_SIZE(s->core_registers));
             ret = s->core_registers[offset];
         }
         break;
@@ -969,7 +969,7 @@ static void xlnx_dp_write(void *opaque, hwaddr offset, uint64_t value,
         xlnx_dp_update_irq(s);
         break;
     default:
-        assert(offset <= (0x504C >> 2));
+        assert(offset < ARRAY_SIZE(s->core_registers));
         s->core_registers[offset] = value;
         break;
     }