[netmojo]

brcmf_pcie_bus_console_read() copies the firmware console ring until its read index reaches the write index the firmware publishes. The read index wraps at bufsize, so a write index of bufsize or more is never reached and the loop does not end. With error set, on the reset path and on the brcmf_pcie_setup() failure path, every line it passes is logged unconditionally through __brcmf_err(). console_interval does not affect these forced reads.

The console description is read again only after a successful firmware download. Reading the source, a download that fails after a reset leaves the previous firmware's description in place, and that stale description can yield an invalid index.

The patch returns, with one rate-limited error, when the write index, the read index or the buffer size cannot describe a position in the ring. Inside those bounds the loop wraps at most once. The check comes after the error/FWCON gate, so a non-forced call with console logging off still reads nothing.

Testing

• Host harness: the function was extracted unchanged and run under ASan and UBSan, with the diagnostic call replaced by a hook. The kernel's ratelimiter and printing were not exercised.
  • Linear, wrapped, empty and last-valid indices behave as before.
  • A write index equal to bufsize, a write index of UINT32_MAX, bufsize == 0, a read index equal to bufsize and a read index of UINT32_MAX each return before any byte read and invoke the diagnostic hook once.
  • Without the patch, the first two do not terminate.
• Hardware: an M1 Pro (BCM4387) on linux-aurora 7.2.11.aurora16 carried this patch through eight reset, unbind and unload runs, one of which ended in a setup failure after a reset.
  • The retained captures contain no console-index diagnostic.
  • The forced dump on that setup failure printed a finite firmware boot log.
• Not tested: a malformed index on hardware. An earlier run without this patch kept logging console lines for minutes after FW failed to initialize. Its index was not captured, so whether this patch would have stopped it is not known.
• Build: module built with clang 23.1.4 against a kernel built with clang 18.1.8, W=1, plain and CONFIG_BRCMDBG. The only warning is Kbuild's notice that the compiler differs from the kernel's, also present when building the base tree.

The patch does not validate buf_addr against the TCM size, and does not refresh a stale console description. An in-range stale index can still print up to one ring of old data.