| Message ID | 20250408061200.76148-1-cuiyunhui@bytedance.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] serial: 8250: fix panic due to PSLVERR | expand |
Hi John, On Tue, Apr 8, 2025 at 8:28 PM John Ogness <john.ogness@linutronix.de> wrote: > > On 2025-04-08, Yunhui Cui <cuiyunhui@bytedance.com> wrote: > > When the PSLVERR_RESP_EN parameter is set to 1, the device generates > > an error response if an attempt is made to read an empty RBR (Receive > > Buffer Register) while the FIFO is enabled. > > > > In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, > > UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes > > dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter > > function enables the FIFO via serial_out(p, UART_FCR, p->fcr). > > Execution proceeds to the dont_test_tx_en label: > > ... > > serial_port_in(port, UART_RX); > > This satisfies the PSLVERR trigger condition. > > > > Because another CPU(e.g., using printk()) is accessing the UART (UART > > is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == > > (lcr & ~UART_LCR_SPAR), causing it to enter dw8250_force_idle(). > > > > To resolve this issue, relevant serial_port_out() operations should be > > placed in a critical section, and UART_RX data should only be read > > when the UART_LSR DR bit is set. > > The UART_LSR_DR check still has a race condition if the console is in > RS485 mode and !SER_RS485_RX_DURING_TX. It seems DW supports this mode > as there is code in dw8250_rs485_config() that sets DW_UART_TCR > differently for this. > > In this mode, serial8250_console_write() will call the callback > ->rs485_stop_tx(), which for DW is serial8250_em485_stop_tx(). And this > calls serial8250_clear_and_reinit_fifos(). > > To really close this race, all UART_RX reads would need to be under the > port lock. Most of them already are. Oh, yes. If there is another reader, there will be a problem. I'll update it to version 3 to fix this issue. > > John Ogness Thanks, Yunhui
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c index 3f256e96c722..3df358008489 100644 --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -2264,13 +2264,16 @@ int serial8250_do_startup(struct uart_port *port) * Clear the FIFO buffers and disable them. * (they will be reenabled in set_termios()) */ + uart_port_lock_irqsave(port, &flags); serial8250_clear_fifos(up); + uart_port_unlock_irqrestore(port, flags); /* * Clear the interrupt registers. */ - serial_port_in(port, UART_LSR); - serial_port_in(port, UART_RX); + lsr = serial_port_in(port, UART_LSR); + if (lsr & UART_LSR_DR) + serial_port_in(port, UART_RX); serial_port_in(port, UART_IIR); serial_port_in(port, UART_MSR); @@ -2380,9 +2383,10 @@ int serial8250_do_startup(struct uart_port *port) /* * Now, initialize the UART */ - serial_port_out(port, UART_LCR, UART_LCR_WLEN8); uart_port_lock_irqsave(port, &flags); + serial_port_out(port, UART_LCR, UART_LCR_WLEN8); + if (up->port.flags & UPF_FOURPORT) { if (!up->port.irq) up->port.mctrl |= TIOCM_OUT1; @@ -2435,8 +2439,9 @@ int serial8250_do_startup(struct uart_port *port) * saved flags to avoid getting false values from polling * routines or the previous session. */ - serial_port_in(port, UART_LSR); - serial_port_in(port, UART_RX); + lsr = serial_port_in(port, UART_LSR); + if (lsr & UART_LSR_DR) + serial_port_in(port, UART_RX); serial_port_in(port, UART_IIR); serial_port_in(port, UART_MSR); up->lsr_saved_flags = 0; @@ -2492,6 +2497,7 @@ void serial8250_do_shutdown(struct uart_port *port) { struct uart_8250_port *up = up_to_u8250p(port); unsigned long flags; + u16 lsr; serial8250_rpm_get(up); /* @@ -2538,7 +2544,9 @@ void serial8250_do_shutdown(struct uart_port *port) * Read data port to reset things, and then unlink from * the IRQ chain. */ - serial_port_in(port, UART_RX); + lsr = serial_port_in(port, UART_LSR); + if (lsr & UART_LSR_DR) + serial_port_in(port, UART_RX); serial8250_rpm_put(up); up->ops->release_irq(up);
When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the dont_test_tx_en label: ... serial_port_in(port, UART_RX); This satisfies the PSLVERR trigger condition. Because another CPU(e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR), causing it to enter dw8250_force_idle(). To resolve this issue, relevant serial_port_out() operations should be placed in a critical section, and UART_RX data should only be read when the UART_LSR DR bit is set. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70 Fixes: c49436b657d0 ("serial: 8250_dw: Improve unwritable LCR workaround") Link: https://lore.kernel.org/all/84cydt5peu.fsf@jogness.linutronix.de/T/ Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com> --- drivers/tty/serial/8250/8250_port.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)