From: Greg Kroah-Hartman Date: Mon, 5 Jun 2023 19:55:09 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.14.317~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ef8e4694493dfe3a22625a20eb81a1ccf5726a20;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch mmc-vub300-fix-invalid-response-handling.patch powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch --- diff --git a/queue-5.15/block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch b/queue-5.15/block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch new file mode 100644 index 00000000000..8bdfae44eed --- /dev/null +++ b/queue-5.15/block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch @@ -0,0 +1,55 @@ +From ff1cc97b1f4c10db224f276d9615b22835b8c424 Mon Sep 17 00:00:00 2001 +From: "Jiri Slaby (SUSE)" +Date: Tue, 13 Dec 2022 13:08:26 +0100 +Subject: block/blk-iocost (gcc13): keep large values in a new enum + +From: Jiri Slaby (SUSE) + +commit ff1cc97b1f4c10db224f276d9615b22835b8c424 upstream. + +Since gcc13, each member of an enum has the same type as the enum [1]. And +that is inherited from its members. Provided: + VTIME_PER_SEC_SHIFT = 37, + VTIME_PER_SEC = 1LLU << VTIME_PER_SEC_SHIFT, + ... + AUTOP_CYCLE_NSEC = 10LLU * NSEC_PER_SEC, +the named type is unsigned long. + +This generates warnings with gcc-13: + block/blk-iocost.c: In function 'ioc_weight_prfill': + block/blk-iocost.c:3037:37: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'long unsigned int' + + block/blk-iocost.c: In function 'ioc_weight_show': + block/blk-iocost.c:3047:34: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int' + +So split the anonymous enum with large values to a separate enum, so +that they don't affect other members. + +[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113 + +Cc: Martin Liska +Cc: Tejun Heo +Cc: Josef Bacik +Cc: Jens Axboe +Cc: cgroups@vger.kernel.org +Cc: linux-block@vger.kernel.org +Signed-off-by: Jiri Slaby (SUSE) +Link: https://lore.kernel.org/r/20221213120826.17446-1-jirislaby@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-iocost.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -232,7 +232,9 @@ enum { + + /* 1/64k is granular enough and can easily be handled w/ u32 */ + WEIGHT_ONE = 1 << 16, ++}; + ++enum { + /* + * As vtime is used to calculate the cost of each IO, it needs to + * be fairly high precision. For example, it should be able to diff --git a/queue-5.15/btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch b/queue-5.15/btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch new file mode 100644 index 00000000000..c72ef40b64b --- /dev/null +++ b/queue-5.15/btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch @@ -0,0 +1,60 @@ +From 5ad9b4719fc9bc4715c7e19875a962095b0577e7 Mon Sep 17 00:00:00 2001 +From: pengfuyuan +Date: Tue, 23 May 2023 15:09:55 +0800 +Subject: btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: pengfuyuan + +commit 5ad9b4719fc9bc4715c7e19875a962095b0577e7 upstream. + +When compiling on a MIPS 64-bit machine we get these warnings: + + In file included from ./arch/mips/include/asm/cacheflush.h:13, + from ./include/linux/cacheflush.h:5, + from ./include/linux/highmem.h:8, + from ./include/linux/bvec.h:10, + from ./include/linux/blk_types.h:10, + from ./include/linux/blkdev.h:9, + from fs/btrfs/disk-io.c:7: + fs/btrfs/disk-io.c: In function ‘csum_tree_block’: + fs/btrfs/disk-io.c:100:34: error: array subscript 1 is above array bounds of ‘struct page *[1]’ [-Werror=array-bounds] + 100 | kaddr = page_address(buf->pages[i]); + | ~~~~~~~~~~^~~ + ./include/linux/mm.h:2135:48: note: in definition of macro ‘page_address’ + 2135 | #define page_address(page) lowmem_page_address(page) + | ^~~~ + cc1: all warnings being treated as errors + +We can check if i overflows to solve the problem. However, this doesn't make +much sense, since i == 1 and num_pages == 1 doesn't execute the body of the loop. +In addition, i < num_pages can also ensure that buf->pages[i] will not cross +the boundary. Unfortunately, this doesn't help with the problem observed here: +gcc still complains. + +To fix this add a compile-time condition for the extent buffer page +array size limit, which would eventually lead to eliminating the whole +for loop. + +CC: stable@vger.kernel.org # 5.10+ +Signed-off-by: pengfuyuan +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/disk-io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -139,7 +139,7 @@ static void csum_tree_block(struct exten + crypto_shash_update(shash, kaddr + BTRFS_CSUM_SIZE, + first_page_part - BTRFS_CSUM_SIZE); + +- for (i = 1; i < num_pages; i++) { ++ for (i = 1; i < num_pages && INLINE_EXTENT_BUFFER_PAGES > 1; i++) { + kaddr = page_address(buf->pages[i]); + crypto_shash_update(shash, kaddr, PAGE_SIZE); + } diff --git a/queue-5.15/iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch b/queue-5.15/iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch new file mode 100644 index 00000000000..c56cb928c1c --- /dev/null +++ b/queue-5.15/iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch @@ -0,0 +1,44 @@ +From 2212fc2acf3f6ee690ea36506fb882a19d1bfcab Mon Sep 17 00:00:00 2001 +From: Jon Pan-Doh +Date: Wed, 26 Apr 2023 13:32:56 -0700 +Subject: iommu/amd: Fix domain flush size when syncing iotlb + +From: Jon Pan-Doh + +commit 2212fc2acf3f6ee690ea36506fb882a19d1bfcab upstream. + +When running on an AMD vIOMMU, we observed multiple invalidations (of +decreasing power of 2 aligned sizes) when unmapping a single page. + +Domain flush takes gather bounds (end-start) as size param. However, +gather->end is defined as the last inclusive address (start + size - 1). +This leads to an off by 1 error. + +With this patch, verified that 1 invalidation occurs when unmapping a +single page. + +Fixes: a270be1b3fdf ("iommu/amd: Use only natural aligned flushes in a VM") +Cc: stable@vger.kernel.org # >= 5.15 +Signed-off-by: Jon Pan-Doh +Tested-by: Sudheer Dantuluri +Suggested-by: Gary Zibrat +Reviewed-by: Vasant Hegde +Acked-by: Nadav Amit +Link: https://lore.kernel.org/r/20230426203256.237116-1-pandoh@google.com +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/amd/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -2222,7 +2222,7 @@ static void amd_iommu_iotlb_sync(struct + unsigned long flags; + + spin_lock_irqsave(&dom->lock, flags); +- domain_flush_pages(dom, gather->start, gather->end - gather->start, 1); ++ domain_flush_pages(dom, gather->start, gather->end - gather->start + 1, 1); + amd_iommu_domain_flush_complete(dom); + spin_unlock_irqrestore(&dom->lock, flags); + } diff --git a/queue-5.15/mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch b/queue-5.15/mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch new file mode 100644 index 00000000000..84392d24c60 --- /dev/null +++ b/queue-5.15/mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch @@ -0,0 +1,113 @@ +From 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sat, 13 May 2023 21:23:52 +0200 +Subject: mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order + +From: Marek Vasut + +commit 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 upstream. + +Chapter "5.3 Power-Up/Down Sequence" of WILC1000 [1] and WILC3000 [2] +states that CHIP_EN must be pulled HIGH first, RESETN second. Fix the +order of these signals in the driver. + +Use the mmc_pwrseq_ops as driver data as the delay between signals is +specific to SDIO card type anyway. + +[1] https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/DataSheets/ATWILC1000-MR110XB-IEEE-802.11-b-g-n-Link-Controller-Module-DS70005326E.pdf +[2] https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/IEEE-802.11-b-g-n-Link-Controller-Module-with-Integrated-Bluetooth-5.0-DS70005327B.pdf + +Fixes: b2832b96fcf5 ("mmc: pwrseq: sd8787: add support for wilc1000") +Signed-off-by: Marek Vasut +Reviewed-by: Claudiu Beznea +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230513192352.479627-1-marex@denx.de +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/pwrseq_sd8787.c | 34 ++++++++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 8 deletions(-) + +diff --git a/drivers/mmc/core/pwrseq_sd8787.c b/drivers/mmc/core/pwrseq_sd8787.c +index 2e120ad83020..0c5f5e371e1f 100644 +--- a/drivers/mmc/core/pwrseq_sd8787.c ++++ b/drivers/mmc/core/pwrseq_sd8787.c +@@ -28,7 +28,6 @@ struct mmc_pwrseq_sd8787 { + struct mmc_pwrseq pwrseq; + struct gpio_desc *reset_gpio; + struct gpio_desc *pwrdn_gpio; +- u32 reset_pwrdwn_delay_ms; + }; + + #define to_pwrseq_sd8787(p) container_of(p, struct mmc_pwrseq_sd8787, pwrseq) +@@ -39,7 +38,7 @@ static void mmc_pwrseq_sd8787_pre_power_on(struct mmc_host *host) + + gpiod_set_value_cansleep(pwrseq->reset_gpio, 1); + +- msleep(pwrseq->reset_pwrdwn_delay_ms); ++ msleep(300); + gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 1); + } + +@@ -51,17 +50,37 @@ static void mmc_pwrseq_sd8787_power_off(struct mmc_host *host) + gpiod_set_value_cansleep(pwrseq->reset_gpio, 0); + } + ++static void mmc_pwrseq_wilc1000_pre_power_on(struct mmc_host *host) ++{ ++ struct mmc_pwrseq_sd8787 *pwrseq = to_pwrseq_sd8787(host->pwrseq); ++ ++ /* The pwrdn_gpio is really CHIP_EN, reset_gpio is RESETN */ ++ gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 1); ++ msleep(5); ++ gpiod_set_value_cansleep(pwrseq->reset_gpio, 1); ++} ++ ++static void mmc_pwrseq_wilc1000_power_off(struct mmc_host *host) ++{ ++ struct mmc_pwrseq_sd8787 *pwrseq = to_pwrseq_sd8787(host->pwrseq); ++ ++ gpiod_set_value_cansleep(pwrseq->reset_gpio, 0); ++ gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 0); ++} ++ + static const struct mmc_pwrseq_ops mmc_pwrseq_sd8787_ops = { + .pre_power_on = mmc_pwrseq_sd8787_pre_power_on, + .power_off = mmc_pwrseq_sd8787_power_off, + }; + +-static const u32 sd8787_delay_ms = 300; +-static const u32 wilc1000_delay_ms = 5; ++static const struct mmc_pwrseq_ops mmc_pwrseq_wilc1000_ops = { ++ .pre_power_on = mmc_pwrseq_wilc1000_pre_power_on, ++ .power_off = mmc_pwrseq_wilc1000_power_off, ++}; + + static const struct of_device_id mmc_pwrseq_sd8787_of_match[] = { +- { .compatible = "mmc-pwrseq-sd8787", .data = &sd8787_delay_ms }, +- { .compatible = "mmc-pwrseq-wilc1000", .data = &wilc1000_delay_ms }, ++ { .compatible = "mmc-pwrseq-sd8787", .data = &mmc_pwrseq_sd8787_ops }, ++ { .compatible = "mmc-pwrseq-wilc1000", .data = &mmc_pwrseq_wilc1000_ops }, + {/* sentinel */}, + }; + MODULE_DEVICE_TABLE(of, mmc_pwrseq_sd8787_of_match); +@@ -77,7 +96,6 @@ static int mmc_pwrseq_sd8787_probe(struct platform_device *pdev) + return -ENOMEM; + + match = of_match_node(mmc_pwrseq_sd8787_of_match, pdev->dev.of_node); +- pwrseq->reset_pwrdwn_delay_ms = *(u32 *)match->data; + + pwrseq->pwrdn_gpio = devm_gpiod_get(dev, "powerdown", GPIOD_OUT_LOW); + if (IS_ERR(pwrseq->pwrdn_gpio)) +@@ -88,7 +106,7 @@ static int mmc_pwrseq_sd8787_probe(struct platform_device *pdev) + return PTR_ERR(pwrseq->reset_gpio); + + pwrseq->pwrseq.dev = dev; +- pwrseq->pwrseq.ops = &mmc_pwrseq_sd8787_ops; ++ pwrseq->pwrseq.ops = match->data; + pwrseq->pwrseq.owner = THIS_MODULE; + platform_set_drvdata(pdev, pwrseq); + +-- +2.41.0 + diff --git a/queue-5.15/mmc-vub300-fix-invalid-response-handling.patch b/queue-5.15/mmc-vub300-fix-invalid-response-handling.patch new file mode 100644 index 00000000000..9687d057e39 --- /dev/null +++ b/queue-5.15/mmc-vub300-fix-invalid-response-handling.patch @@ -0,0 +1,64 @@ +From a99d21cefd351c8aaa20b83a3c942340e5789d45 Mon Sep 17 00:00:00 2001 +From: Deren Wu +Date: Sat, 13 May 2023 22:48:15 +0800 +Subject: mmc: vub300: fix invalid response handling + +From: Deren Wu + +commit a99d21cefd351c8aaa20b83a3c942340e5789d45 upstream. + +We may get an empty response with zero length at the beginning of +the driver start and get following UBSAN error. Since there is no +content(SDRT_NONE) for the response, just return and skip the response +handling to avoid this problem. + +Test pass : SDIO wifi throughput test with this patch + +[ 126.980684] UBSAN: array-index-out-of-bounds in drivers/mmc/host/vub300.c:1719:12 +[ 126.980709] index -1 is out of range for type 'u32 [4]' +[ 126.980729] CPU: 4 PID: 9 Comm: kworker/u16:0 Tainted: G E 6.3.0-rc4-mtk-local-202304272142 #1 +[ 126.980754] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 +[ 126.980770] Workqueue: kvub300c vub300_cmndwork_thread [vub300] +[ 126.980833] Call Trace: +[ 126.980845] +[ 126.980860] dump_stack_lvl+0x48/0x70 +[ 126.980895] dump_stack+0x10/0x20 +[ 126.980916] ubsan_epilogue+0x9/0x40 +[ 126.980944] __ubsan_handle_out_of_bounds+0x70/0x90 +[ 126.980979] vub300_cmndwork_thread+0x58e7/0x5e10 [vub300] +[ 126.981018] ? _raw_spin_unlock+0x18/0x40 +[ 126.981042] ? finish_task_switch+0x175/0x6f0 +[ 126.981070] ? __switch_to+0x42e/0xda0 +[ 126.981089] ? __switch_to_asm+0x3a/0x80 +[ 126.981129] ? __pfx_vub300_cmndwork_thread+0x10/0x10 [vub300] +[ 126.981174] ? __kasan_check_read+0x11/0x20 +[ 126.981204] process_one_work+0x7ee/0x13d0 +[ 126.981246] worker_thread+0x53c/0x1240 +[ 126.981291] kthread+0x2b8/0x370 +[ 126.981312] ? __pfx_worker_thread+0x10/0x10 +[ 126.981336] ? __pfx_kthread+0x10/0x10 +[ 126.981359] ret_from_fork+0x29/0x50 +[ 126.981400] + +Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") +Signed-off-by: Deren Wu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/048cd6972c50c33c2e8f81d5228fed928519918b.1683987673.git.deren.wu@mediatek.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/vub300.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mmc/host/vub300.c ++++ b/drivers/mmc/host/vub300.c +@@ -1715,6 +1715,9 @@ static void construct_request_response(s + int bytes = 3 & less_cmd; + int words = less_cmd >> 2; + u8 *r = vub300->resp.response.command_response; ++ ++ if (!resp_len) ++ return; + if (bytes == 3) { + cmd->resp[words] = (r[1 + (words << 2)] << 24) + | (r[2 + (words << 2)] << 16) diff --git a/queue-5.15/powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch b/queue-5.15/powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch new file mode 100644 index 00000000000..26d80488aa9 --- /dev/null +++ b/queue-5.15/powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch @@ -0,0 +1,59 @@ +From 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e Mon Sep 17 00:00:00 2001 +From: Gaurav Batra +Date: Thu, 25 May 2023 09:34:54 -0500 +Subject: powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gaurav Batra + +commit 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e upstream. + +Currently in tce_freemulti_pSeriesLP() there is no limit on how many +TCEs are passed to the H_STUFF_TCE hcall. This has not caused an issue +until now, but newer firmware releases have started enforcing a limit of +512 TCEs per call. + +The limit is correct per the specification (PAPR v2.12 § 14.5.4.2.3). + +The code has been in it's current form since it was initially merged. + +Cc: stable@vger.kernel.org +Signed-off-by: Gaurav Batra +Reviewed-by: Brian King +[mpe: Tweak change log wording & add PAPR reference] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230525143454.56878-1-gbatra@linux.vnet.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/pseries/iommu.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -311,13 +311,22 @@ static void tce_free_pSeriesLP(unsigned + static void tce_freemulti_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages) + { + u64 rc; ++ long rpages = npages; ++ unsigned long limit; + + if (!firmware_has_feature(FW_FEATURE_STUFF_TCE)) + return tce_free_pSeriesLP(tbl->it_index, tcenum, + tbl->it_page_shift, npages); + +- rc = plpar_tce_stuff((u64)tbl->it_index, +- (u64)tcenum << tbl->it_page_shift, 0, npages); ++ do { ++ limit = min_t(unsigned long, rpages, 512); ++ ++ rc = plpar_tce_stuff((u64)tbl->it_index, ++ (u64)tcenum << tbl->it_page_shift, 0, limit); ++ ++ rpages -= limit; ++ tcenum += limit; ++ } while (rpages > 0 && !rc); + + if (rc && printk_ratelimit()) { + printk("tce_freemulti_pSeriesLP: plpar_tce_stuff failed\n"); diff --git a/queue-5.15/series b/queue-5.15/series index 5c9994a6f09..03f25e833ef 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -120,3 +120,10 @@ drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-yellow-carp.patch drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-renoir.patch x86-boot-wrap-literal-addresses-in-absolute_pointer.patch ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch +block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch +mmc-vub300-fix-invalid-response-handling.patch +mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch +tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch +btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch +powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch +iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch diff --git a/queue-5.15/tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch b/queue-5.15/tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch new file mode 100644 index 00000000000..8d5e10b424e --- /dev/null +++ b/queue-5.15/tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch @@ -0,0 +1,102 @@ +From 2474e05467c00f7d51af3039b664de6886325257 Mon Sep 17 00:00:00 2001 +From: Sherry Sun +Date: Fri, 19 May 2023 17:47:51 +0800 +Subject: tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK + +From: Sherry Sun + +commit 2474e05467c00f7d51af3039b664de6886325257 upstream. + +LPUART IP now has two known bugs, one is that CTS has higher priority +than the break signal, which causes the break signal sending through +UARTCTRL_SBK may impacted by the CTS input if the HW flow control is +enabled. It exists on all platforms we support in this driver. +So we add a workaround patch for this issue: commit c4c81db5cf8b +("tty: serial: fsl_lpuart: disable the CTS when send break signal"). + +Another IP bug is i.MX8QM LPUART may have an additional break character +being sent after SBK was cleared. It may need to add some delay between +clearing SBK and re-enabling CTS to ensure that the SBK latch are +completely cleared. + +But we found that during the delay period before CTS is enabled, there +is still a risk that Bluetooth data in TX FIFO may be sent out during +this period because of break off and CTS disabled(even if BT sets CTS +line deasserted, data is still sent to BT). + +Due to this risk, we have to drop the CTS-disabling workaround for SBK +bugs, use TXINV seems to be a better way to replace SBK feature and +avoid above risk. Also need to disable the transmitter to prevent any +data from being sent out during break, then invert the TX line to send +break. Then disable the TXINV when turn off break and re-enable +transmitter. + +Fixes: c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal") +Cc: stable +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20230519094751.28948-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/fsl_lpuart.c | 44 ++++++++++++++++++++-------------------- + 1 file changed, 23 insertions(+), 21 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1491,34 +1491,36 @@ static void lpuart_break_ctl(struct uart + + static void lpuart32_break_ctl(struct uart_port *port, int break_state) + { +- unsigned long temp, modem; +- struct tty_struct *tty; +- unsigned int cflag = 0; ++ unsigned long temp; + +- tty = tty_port_tty_get(&port->state->port); +- if (tty) { +- cflag = tty->termios.c_cflag; +- tty_kref_put(tty); +- } +- +- temp = lpuart32_read(port, UARTCTRL) & ~UARTCTRL_SBK; +- modem = lpuart32_read(port, UARTMODIR); ++ temp = lpuart32_read(port, UARTCTRL); + ++ /* ++ * LPUART IP now has two known bugs, one is CTS has higher priority than the ++ * break signal, which causes the break signal sending through UARTCTRL_SBK ++ * may impacted by the CTS input if the HW flow control is enabled. It ++ * exists on all platforms we support in this driver. ++ * Another bug is i.MX8QM LPUART may have an additional break character ++ * being sent after SBK was cleared. ++ * To avoid above two bugs, we use Transmit Data Inversion function to send ++ * the break signal instead of UARTCTRL_SBK. ++ */ + if (break_state != 0) { +- temp |= UARTCTRL_SBK; + /* +- * LPUART CTS has higher priority than SBK, need to disable CTS before +- * asserting SBK to avoid any interference if flow control is enabled. ++ * Disable the transmitter to prevent any data from being sent out ++ * during break, then invert the TX line to send break. + */ +- if (cflag & CRTSCTS && modem & UARTMODIR_TXCTSE) +- lpuart32_write(port, modem & ~UARTMODIR_TXCTSE, UARTMODIR); ++ temp &= ~UARTCTRL_TE; ++ lpuart32_write(port, temp, UARTCTRL); ++ temp |= UARTCTRL_TXINV; ++ lpuart32_write(port, temp, UARTCTRL); + } else { +- /* Re-enable the CTS when break off. */ +- if (cflag & CRTSCTS && !(modem & UARTMODIR_TXCTSE)) +- lpuart32_write(port, modem | UARTMODIR_TXCTSE, UARTMODIR); ++ /* Disable the TXINV to turn off break and re-enable transmitter. */ ++ temp &= ~UARTCTRL_TXINV; ++ lpuart32_write(port, temp, UARTCTRL); ++ temp |= UARTCTRL_TE; ++ lpuart32_write(port, temp, UARTCTRL); + } +- +- lpuart32_write(port, temp, UARTCTRL); + } + + static void lpuart_setup_watermark(struct lpuart_port *sport)