Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3779685pxt; Tue, 10 Aug 2021 11:08:00 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy4PD4lf8XScdCDGaPuEl5kw+dWKIuKSVYg/kAYdyJiWRGV8dwkej68idqCDFMagqBV7sdE X-Received: by 2002:a05:6638:449:: with SMTP id r9mr27970358jap.137.1628618880293; Tue, 10 Aug 2021 11:08:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628618880; cv=none; d=google.com; s=arc-20160816; b=oHGB/TdYsmWvUqwpcN0BcJLEK6Q4JMbXglIgpUhKva0yxJpcy2Io7gpuVSqpD7/Fyx fM2YFGPQlVN/SM/DqvxeoQRoEwK+ekqMVnrI91gxVfEbac6ZzhqmMAF1ByAm34JuIkBc bBbpuvshW8u8pfSCrOB0PIMvhOB0EbYuerq9w6ljPvM2hYnLv3Vrk1hpWd0z/i95klBD jT7t06jQS7OzRif9kuFsCKrrg6v7AuHTiAi07jooNdt7isFe6d+xaI9VqiJvhMsvMgzQ PCKx8s236GpnWfFXPyblR8dAeI/KBhDLORmMdn3AjlIX6AaUT6YYTaH6vxipVkYFnzED 94bg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=5E3iaUOxMAM8kdDEq+b3CpsVk35o1BRRFoTvdA3nVLQ=; b=ToOJf9SiC4gK8dyxszplWMMeSS75YU7oB5pdatFaSFH0146vVRaSrPyP6CTd880zxf aiuaVaAxJv9tb2MU5rDgNTTGIY/OrjGnR1iEUbVM9otb8iJLqFIsCa6rlngbfm7k+M4H QTkQSRUBr72SOCBFege6kr4rP/igQK2kcuPZV4RPCEiQMctUfjj0Mx/wRFbyL66uTrlH zADecWBuzeZGWm6RjCP6pZCSlmYPR4puFJ0qYKepE3EgunVaCAFrmbA79GAK0SXsxjuY rsHS96kmVgayIqpa212MBYWtdrEQranVXkASaLlIzFZYSF5UegYoy72lpOcbV7Jcj9rJ FErA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Lrz5snba; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id i10si946257iol.58.2021.08.10.11.07.48; Tue, 10 Aug 2021 11:08:00 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Lrz5snba; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238572AbhHJSEV (ORCPT + 99 others); Tue, 10 Aug 2021 14:04:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:34364 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238632AbhHJR7t (ORCPT ); Tue, 10 Aug 2021 13:59:49 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id AA05D61163; Tue, 10 Aug 2021 17:46:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628617594; bh=wgnheUtTqVXkI+dOwvW0SDDy8BvYTcks6rBRxanHGTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lrz5snba5a2CXKXjKr3u73g5FPB/BPbNNnDOn7TeHR9kWmC7BQntfsdZLRw9+sJ9d TJMIOkXaOwao6nqkW58nXs+qlfZ8XF5oaipm10uzY+Sxwj4VMH9NBz0eeqxvxsv3QD OJLse2bRAzePQS0G/5l4XWWMmpA4s7dKaDdynv5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , "Maciej W. Rozycki" Subject: [PATCH 5.13 126/175] serial: 8250: Mask out floating 16/32-bit bus bits Date: Tue, 10 Aug 2021 19:30:34 +0200 Message-Id: <20210810173005.104054267@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810173000.928681411@linuxfoundation.org> References: <20210810173000.928681411@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maciej W. Rozycki commit e5227c51090e165db4b48dcaa300605bfced7014 upstream. Make sure only actual 8 bits of the IIR register are used in determining the port type in `autoconfig'. The `serial_in' port accessor returns the `unsigned int' type, meaning that with UPIO_AU, UPIO_MEM16, UPIO_MEM32, and UPIO_MEM32BE access types more than 8 bits of data are returned, of which the high order bits will often come from bus lines that are left floating in the data phase. For example with the MIPS Malta board's CBUS UART, where the registers are aligned on 8-byte boundaries and which uses 32-bit accesses, data as follows is returned: YAMON> dump -32 0xbf000900 0x40 BF000900: 1F000942 1F000942 1F000900 1F000900 ...B...B........ BF000910: 1F000901 1F000901 1F000900 1F000900 ................ BF000920: 1F000900 1F000900 1F000960 1F000960 ...........`...` BF000930: 1F000900 1F000900 1F0009FF 1F0009FF ................ YAMON> Evidently high-order 24 bits return values previously driven in the address phase (the 3 highest order address bits used with the command above are masked out in the simple virtual address mapping used here and come out at zeros on the external bus), a common scenario with bus lines left floating, due to bus capacitance. Consequently when the value of IIR, mapped at 0x1f000910, is retrieved in `autoconfig', it comes out at 0x1f0009c1 and when it is right-shifted by 6 and then assigned to 8-bit `scratch' variable, the value calculated is 0x27, not one of 0, 1, 2, 3 expected in port type determination. Fix the issue then, by assigning the value returned from `serial_in' to `scratch' first, which masks out 24 high-order bits retrieved, and only then right-shift the resulting 8-bit data quantity, producing the value of 3 in this case, as expected. Fix the same issue in `serial_dl_read'. The problem first appeared with Linux 2.6.9-rc3 which predates our repo history, but the origin could be identified with the old MIPS/Linux repo also at: as commit e0d2356c0777 ("Merge with Linux 2.6.9-rc3."), where code in `serial_in' was updated with this case: + case UPIO_MEM32: + return readl(up->port.membase + offset); + which made it produce results outside the unsigned 8-bit range for the first time, though obviously it is system dependent what actual values appear in the high order bits retrieved and it may well have been zeros in the relevant positions with the system the change originally was intended for. It is at that point that code in `autoconf' should have been updated accordingly, but clearly it was overlooked. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org # v2.6.12+ Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Maciej W. Rozycki Link: https://lore.kernel.org/r/alpine.DEB.2.21.2106260516220.37803@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/8250/8250_port.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -311,7 +311,11 @@ static const struct serial8250_config ua /* Uart divisor latch read */ static int default_serial_dl_read(struct uart_8250_port *up) { - return serial_in(up, UART_DLL) | serial_in(up, UART_DLM) << 8; + /* Assign these in pieces to truncate any bits above 7. */ + unsigned char dll = serial_in(up, UART_DLL); + unsigned char dlm = serial_in(up, UART_DLM); + + return dll | dlm << 8; } /* Uart divisor latch write */ @@ -1297,9 +1301,11 @@ static void autoconfig(struct uart_8250_ serial_out(up, UART_LCR, 0); serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO); - scratch = serial_in(up, UART_IIR) >> 6; - switch (scratch) { + /* Assign this as it is to truncate any bits above 7. */ + scratch = serial_in(up, UART_IIR); + + switch (scratch >> 6) { case 0: autoconfig_8250(up); break;