Commit 863c33a3c0 for qemu.org

commit 863c33a3c0c874a8a499dc60fbdd23f656f41d7a
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:51 2026 +0400

    hw/char/sh_serial: use rx_cnt for available FIFO space

    sh_serial_can_receive() used rx_head (the circular buffer write pointer)
    to compute available space. Since rx_head wraps around, this could
    overestimate or underestimate the remaining capacity.  Use rx_cnt, which
    tracks the actual number of buffered bytes.

    Reported-by: Pavee Hui <phui@google.com>
    Fixes: 543671d9907f ("hw/char/sh_serial: Return correct number of empty RX FIFO elements")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com>
    Message-ID: <20261004-issue-4560-v1-37-ccbef537cbeb@redhat.com>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 30a22ea2d1..8728842b84 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -316,7 +316,7 @@ static uint64_t sh_serial_read(void *opaque, hwaddr offs,

 static int sh_serial_can_receive(SHSerialState *s)
 {
-    return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_head : 0;
+    return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_cnt : 0;
 }

 static void sh_serial_receive_break(SHSerialState *s)