Assertion failure: "Software attempted to set USART TC bit"

[moyix]

I'm trying to emulate the pebble firmware images from https://github.com/pebble/qemu-tintin-images – specifically, the aplite/2.9/{qemu_micro_flash.bin,qemu_spi_flash.bin} flash images.

I compiled with:

../configure --enable-debug --target-list="arm-softmmu" --extra-cflags=-DDEBUG_STM32_RCC --extra-cflags=-DDEBUG_STM32_UART --extra-cflags=-DSTM32_UART_ENABLE_OVERRUN --extra-cflags=-DDEBUG_GIC --prefix=$(pwd)/install

And made a symlink to the image directory. However, running pebble.py produces:

192:build moyix$ ../pebble.py 
Executing command line: 
    qemu-system-arm -rtc base=localtime -s -serial file:uart1.log -serial tcp::12344,server,nowait -serial tcp::12345,server,nowait -monitor stdio -machine pebble-bb2 -cpu cortex-m3 -pflash ../test_images/qemu_micro_flash.bin -mtdblock ../test_images/qemu_spi_flash.bin 
WARNING: Image format was not specified for '../test_images/qemu_micro_flash.bin' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
WARNING: Image format was not specified for '../test_images/qemu_spi_flash.bin' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
QEMU 2.5.0-pebble4 monitor - type 'help' for more information
(qemu) STM32_UART: STM32_UART1 clock is set to 0 Hz.
STM32_UART: STM32_UART1 BRR set to 0.
STM32_UART: STM32_UART1 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART2 clock is set to 0 Hz.
STM32_UART: STM32_UART2 BRR set to 0.
STM32_UART: STM32_UART2 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART3 clock is set to 0 Hz.
STM32_UART: STM32_UART3 BRR set to 0.
STM32_UART: STM32_UART3 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART4 clock is set to 0 Hz.
STM32_UART: STM32_UART4 BRR set to 0.
STM32_UART: STM32_UART4 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART5 clock is set to 0 Hz.
STM32_UART: STM32_UART5 BRR set to 0.
STM32_UART: STM32_UART5 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART6 clock is set to 0 Hz.
STM32_UART: STM32_UART6 BRR set to 0.
STM32_UART: STM32_UART6 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART6 clock is set to 0 Hz.
STM32_UART: STM32_UART6 BRR set to 0.
STM32_UART: STM32_UART6 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART5 clock is set to 0 Hz.
STM32_UART: STM32_UART5 BRR set to 0.
STM32_UART: STM32_UART5 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART4 clock is set to 0 Hz.
STM32_UART: STM32_UART4 BRR set to 0.
STM32_UART: STM32_UART4 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART3 clock is set to 0 Hz.
STM32_UART: STM32_UART3 BRR set to 0.
STM32_UART: STM32_UART3 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART2 clock is set to 0 Hz.
STM32_UART: STM32_UART2 BRR set to 0.
STM32_UART: STM32_UART2 Baud is set to 0 bits per sec.
STM32_UART: STM32_UART1 clock is set to 0 Hz.
STM32_UART: STM32_UART1 BRR set to 0.
STM32_UART: STM32_UART1 Baud is set to 0 bits per sec.
STM32F2XX_RCC: Cortex SYSTICK frequency set to 16000000 Hz (scale set to 62).
DEBUG_GIC: Enabled IRQ 127
DEBUG_GIC: Enabled IRQ 128
STM32_UART: STM32_UART3 clock is set to 16000000 Hz.
STM32_UART: STM32_UART3 BRR set to 0.
STM32_UART: STM32_UART3 Baud is set to 0 bits per sec.
qemu: hardware error: Software attempted to set USART TC bit

CPU #0:
R00=40020c00 R01=00000100 R02=00070008 R03=000000c0
R04=08002cb4 R05=40004800 R06=00000064 R07=00000000
R08=00000000 R09=00000000 R10=00000000 R11=00000000
R12=00000000 R13=2001a9a0 R14=08000897 R15=08000896
PSR=00000173 ---- T svc32
FPSCR: 00000000
xPSR:      01000000
MSP:       2001a9a0
PSP:       00000000
PRIMASK:   00000000
BASEPRI:   00000000
FAULTMASK: 00000001
CONTROL:   00000000

I've tried commenting that hw_error, but it ends up failing on another one almost immediately (related to trying to write to the DR register before the UART has been enabled).

Any idea what's going wrong here? Am I using the wrong images? I several of the other images from the qemu-tintin-images repository, and I tried specifying some of the other pebble machine types, to no avail.